Question

I have this databases: table<User>(UserID,Name,Surname,Username,Password,Email), table<Role>(RoleID,RoleName,Description), and table<UsersInRole>(UserID,RoleID). I create a login authentication with username and password to access to the application (with Linq ToSql to store data), and it is right. Now I wish to create a role for each user, but I don’t know how work out it; I saw some features about it but it refers to web.app.

This is the code of the procedure that applies to login:

public partial class Window1 : Window     {         public Window1()         {             InitializeComponent();         }           public bool ValidateApplicationUser(string userName, string password)         {           {                 var AuthContext = new DataClasses1DataContext();                 var query = from c in  AuthContext.Users                             where (c.Username == userName.ToLower() && c.Password == password.ToLower())                             select c;                  if(query.Count() != 0 )                 {                     return true;                 }                  return false;             }          }          private void mahhh(object sender, RoutedEventArgs e)         {             bool authenticated = true;             {                 if (usernameTextBox.Text !='' && passwordTextBox.Text != '')                 {                     authenticated = ValidateApplicationUser(usernameTextBox.Text , passwordTextBox.Text);                 }              }             if (!authenticated)             {                 MessageBox.Show('Invalid login. Try again.');             }             else             {                 MessageBox.Show('Congradulations! You're a valid user!');                 Window3 c = new Window3();                 c.ShowDialog();                 this.Close();             }         }     } 

I don’t know how to implement a method to assign a role to the user. Do you have any idea or suggest to make it right?

Answer 1

First, try not to store passwords in the database; it is better to store a hash. I’m not quite sure what you mean ‘assign a role to the user’ – are you having difficulty getting the role from the db? Or are you unsure what to do with it afterwards? If the latter, the ‘principal’ is the way to go; at the simplest level:

        string username = ...         string[] roles = ...         Thread.CurrentPrincipal = new GenericPrincipal(             new GenericIdentity(username), roles); 

Now you can use role-based security, either declarative or imperative.

Declarative:

    [PrincipalPermission(SecurityAction.Demand, Role='ADMIN')]     public void Foo()     { // validated automatically by the .NET runtime ;-p      } 

Imperative:

    static bool IsInRole(string role)     {         IPrincipal principal = Thread.CurrentPrincipal;         return principal != null && principal.IsInRole(role);     }     ...     bool isAdmin = IsInRole('ADMIN');