Willem Meints

Using ASP.NET application services from Silverlight

2010-03-08T19:32:43Z

Silverlight is a platform the behaves pretty much like any windows application. This makes sense when you think about where the application is actually running. It is deployed from a website, but doesn’t actually run on the web server.

Because Silverlight doesn’t run on the server you should prepare for a little more complex of way of enforcing permissions and setting up a solution to authenticate users. The basics are not that different from what you might be doing in Windows Forms or WPF. There are however new tools available that make setting up authentication and authorization of users a whole lot simpler.

In this article I’m going to show how you can use ASP.NET application services to enable authentication and authorization of users inside a Silverlight application.

Application services for ASP.NET

In ASP.NET you can choose between different providers to authenticate and authorize users on the website. There’s the membership provider, the role provider and the profile provider which can use for authentication, authorization and to create a user profile. These providers can be accessed from the code behind by calling the correct methods on these providers.

There is also another way of accessing the various providers offered by ASP.NET, by using a WCF service that you can expose on your website. You don’t need to implement them yourself, all that is needed is to create the necessary endpoints and setup the correct configuration.

Setting up the database for the application services

Before you can start using the various providers for membership, roles and profiles you will need a database that contains the data for all of these areas. To do this you will need to execute the following application from within the .NET Framework directory:

C:\windows\microsoft.net\Framework\v2.0.50727\aspnet_regsql.exe
C:\windows\microsoft.net\Framework\v4.0.30128\aspnet_regsql.exe

When you start the utility you will be presented with the following wizard.

You can choose to create a new asp.net application services database. You can also use this wizard to remove an existing application services database.

Once you have the database you can update the connection string used by the various providers in the web application to connect to the new application services database.

Enabling the authentication service

To use the authentication service in Silverlight you will need to enable forms authentication and setup the membership provider with a custom database.

To configure the web application for forms authentication you can set the <authentication> element to <authentication mode=”Forms”/>

After you have enabled forms authentication you will need to setup the membership provider. The following XML snippet demonstrates how the membership provider can be configured.

        1: <membership defaultProvider="TaskTrackerMembershipProvider">

       2:   <providers>

       3:     <add name="TaskTrackerMembershipProvider" type="System.Web.Security.SqlMembershipProvider"

       4:          connectionStringName="ApplicationServices"

       5:          enablePasswordRetrieval="false"

       6:          enablePasswordReset="true"

       7:          requiresQuestionAndAnswer="false"

       8:          requiresUniqueEmail="false"

       9:          maxInvalidPasswordAttempts="5"

      10:          minRequiredPasswordLength="6"

      11:          minRequiredNonalphanumericCharacters="0"

      12:          passwordAttemptWindow="10"

      13:          applicationName="/" />

      14:   </providers>

      15: </membership>

The next step in making the authentication service available to Silverlight is to setup the WCF services. For this you will need to create a new file with the name Authentication.svc inside your web application. The service file should contain the following content:

       1: <%@ ServiceHost Language="C#" Service="System.Web.ApplicationServices.AuthenticationService" %>

Next you will need to configure the service in the web.config file of the application. The configuration should look similar to the following snippet:

       1: <system.serviceModel>

       2:   <!-- Required for the application services to work correctly -->

       3:   <serviceHostingEnvironment aspNetCompatibilityEnabled="true" />

       4:   <behaviors>

       5:     <serviceBehaviors>

       6:       <!-- New feature in .NET 4, default behaviors -->

       7:       <behavior>

       8:         <serviceMetadata httpGetEnabled="true"/>

       9:         <serviceDebug includeExceptionDetailInFaults="true"/>

      10:       </behavior>

      11:     </serviceBehaviors>

      12:   </behaviors>

      13:   <services>

      14:     <service name="System.Web.ApplicationServices.AuthenticationService">

      15:       <endpoint address="" binding="basicHttpBinding" contract="System.Web.ApplicationServices.AuthenticationService"/>

      16:       <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>

      17:       <!-- ... Other services ... -->

      18:     </service>

      19:   </services>

      20: </system.serviceModel>

The web service is now available when you request the service file from the web address the website is hosted on. It is however not possible to call it from any external application. To enable this you will need to add an extra piece of configuration that enables the authentication service.

       1: <system.web.extensions>

       2:   <scripting>

       3:     <webServices>

       4:       <authenticationService enabled="true"/>

       5:       <!-- ... Other application services ... -->

       6:     </webServices>

       7:   </scripting>

       8: </system.web.extensions>

Enabling the role service

The membership provider that is configured in the previous section enables users to authenticate themselves. The provider however doesn’t allow for the application to enforce role-based authorization.

To enable role-based authorization in Silverlight you will need to enable the roles provider and the roles webservice for ASP.NET.

Enabling the roles provider is done by adding a roles provider to the web.config file of the web application. The following snippet demonstrates this:

       1: <roleManager enabled="true" defaultProvider="TaskTrackerRoleProvider">

       2:   <providers>

       3:     <add connectionStringName="ApplicationServices" applicationName="/"

       4:          name="TaskTrackerRoleProvider" type="System.Web.Security.SqlRoleProvider" />

       5:   </providers>

       6: </roleManager>

The provider uses the same database as the membership provider, so there’s no need to create a new database. Although you could of course do that if you have the need for it.

After configuring the roles provider you can enable webservice access by creating a new svc file with the following content:

       1: <%@ ServiceHost Language="C#" Service="System.Web.ApplicationServices.RoleService" %>

To finalize the configuration of the webservice you will also need to update the WCF configuration in the web.config file of the web application by adding the following snippet of XML to the system.serviceModel section:

       1: <services>

       2:   <!-- ... Other services ... -->

       3:   <service name="System.Web.ApplicationServices.RoleService">

       4:     <endpoint address="" binding="basicHttpBinding" contract="System.Web.ApplicationServices.RoleService"/>

       5:     <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>

       6:   </service>

       7: </services>

Finally you need to enable the roles service in the system.web.extensions section of the web.config file. The following snippet demonstrates this:

       1: <system.web.extensions>

       2:   <scripting>

       3:     <webServices>

       4:       <authenticationService enabled="true"/>

       5:       <roleService enabled="true"/>

       6:       <!-- ... Other services ... -->

       7:     </webServices>

       8:   </scripting>

       9: </system.web.extensions>

Enabling the profile service

Configuring the profile service is completely optional. With the authentication service and roles service you already have enough to setup a complete authorization model for Silverlight. The profile service however adds more options by enabling users to have profile properties that can be read and written from the Silverlight application.

Setting up the profile provider works the same as for the other providers. Add the following snippet to the web.config file to setup the profile provider itself:

       1: <profile enabled="true" defaultProvider="TaskTrackerProfileProvider">

       2:   <providers>

       3:     <add name="TaskTrackerProfileProvider"

       4:          type="System.Web.Profile.SqlProfileProvider"

       5:          connectionStringName="ApplicationServices"

       6:          applicationName="/" />

       7:   </providers>

       8: </profile>

After that you can create a new service file and add configuration for the service file. Here’s the contents of the service file:

       1: <%@ ServiceHost Language="C#" Service="System.Web.ApplicationServices.ProfileService" %>

The following snippet demonstrates the configuration that needs to be added to the system.serviceModel section of the web.config file in the web application:

       1: <services>

       2:   <!-- ... Other services ... -->

       3:   <service name="System.Web.ApplicationServices.ProfileService">

       4:     <endpoint address="" binding="basicHttpBinding" contract="System.Web.ApplicationServices.ProfileService"/>

       5:     <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>

       6:   </service>

       7: </services>

Finally you need to enable the profile provider by adding the following snippet to the system.web.extensions section.

       1: <system.web.extensions>

       2:   <scripting>

       3:     <webServices>

       4:       <authenticationService enabled="true"/>

       5:       <roleService enabled="true"/>

       6:       <profileService enabled="true"/>

       7:     </webServices>

       8:   </scripting>

       9: </system.web.extensions>

Using application services from Silverlight

Once the services have been configured you can access them from Silverlight by adding a service reference to them in Visual Studio. When you’ve enabled the mex endpoints on the services and specified the behavior for service metadata you should be able to click discover in the Add service reference dialog and have a list of application services show right up in the dialog.

Getting a proxy instance for an application service

By default Visual Studio will generate a proxy for the application services with an URI specified that points towards the location the service was originally located. This is fine on a development environment, but when you change the URI of the webservice you will also need to update the URI inside the XAP package. This is not really what you want when running on a production server.

To make things a little simpler I’ve created a combination of an extension method and a factory class that makes getting a new instance of a service proxy a breeze.

       1: /// <summary>

       2: /// Provides some useful extensions on the application class

       3: /// </summary>

       4: public static class ApplicationExtensionMethods

       5: {

       6:     /// <summary>

       7:     /// Combines the path of the Silverlight application and a relative path

       8:     /// into one absolute URI.

       9:     /// </summary>

    /// <param name="application">Running application</param>

    /// <param name="path">Relative path to convert</param>

    /// <returns>Returns the full URI to the specified relative path</returns>

    public static Uri GetRelativeUri(this Application application, string path)

    {

        const char UriSeparator = '/';

  

        string sourceFileUri = application.Host.Source.AbsoluteUri;

        string[] sourceFileUriParts = sourceFileUri.Split(UriSeparator);

        string clientBinFolderPath = sourceFileUriParts[sourceFileUriParts.Length - 2];

        string outputFolderPath = null;

  

        if (clientBinFolderPath.ToLower() == "clientbin")

        {

            outputFolderPath = String.Join(UriSeparator.ToString(), 

                sourceFileUriParts.Take(sourceFileUriParts.Length - 2).ToArray());

        }

        else

        {

            outputFolderPath = String.Join(UriSeparator.ToString(), 

                sourceFileUriParts.Take(sourceFileUriParts.Length - 1).ToArray());

        }

  

        return new Uri(String.Format("{0}{1}{2}", outputFolderPath, UriSeparator, path), 

            UriKind.RelativeOrAbsolute);

    }

}

The extension method makes it possible to combine a relative URI with the absolute URI of the location where the Silverlight application is hosted. This method can be reused to locate various other resources from the website.

The factory class combines a two-step operation to configure the address and binding for each service requested. Each service that can be created has its own method on the factory class, you can however make this more generic if you want to. This implementation however helps to keep things straightforward and easier to maintain.

       1: /// <summary>

       2: /// Automates the creation of the various agents in the frontend

       3: /// </summary>

       4: public static class ServiceFactory

       5: {

       6:     #region Public methods

       7:  

       8:     /// <summary>

       9:     /// Creates a new service proxy for the authentication service

    /// </summary>

    /// <returns></returns>

    public static AuthenticationServiceClient CreateAuthenticationClient()

    {

        Uri serviceAddress = Application.Current.GetRelativeUri("Services/Authentication.svc");

        Binding serviceBinding = CreateBindingForAddress(serviceAddress);

        

        EndpointAddressBuilder addressBuilder = new EndpointAddressBuilder();

        addressBuilder.Uri = serviceAddress;

  

        return new AuthenticationServiceClient(serviceBinding, addressBuilder.ToEndpointAddress());

    }

  

    /// <summary>

    /// Creates a new service proxy for the profile service

    /// </summary>

    /// <returns></returns>

    public static ProfileServiceClient CreateProfileClient()

    {

        Uri serviceAddress = Application.Current.GetRelativeUri("Services/Profile.svc");

        Binding serviceBinding = CreateBindingForAddress(serviceAddress);

  

        EndpointAddressBuilder addressBuilder = new EndpointAddressBuilder();

        addressBuilder.Uri = serviceAddress;

  

        return new ProfileServiceClient(serviceBinding, addressBuilder.ToEndpointAddress());

    }

  

    /// <summary>

    /// Creates a new service proxy for the role service

    /// </summary>

    /// <returns></returns>

    public static RoleServiceClient CreateRoleClient()

    {

        Uri serviceAddress = Application.Current.GetRelativeUri("Services/Roles.svc");

        Binding serviceBinding = CreateBindingForAddress(serviceAddress);

  

        EndpointAddressBuilder addressBuilder = new EndpointAddressBuilder();

        addressBuilder.Uri = serviceAddress;

  

        return new RoleServiceClient(serviceBinding, addressBuilder.ToEndpointAddress());

    }

    

    #endregion

  

    #region Private methods

  

    /// <summary>

    /// Creates a binding for the specified address

    /// </summary>

    /// <param name="address">Address of the service</param>

    /// <returns>Returns the channel binding to use</returns>

    private static Binding CreateBindingForAddress(Uri address)

    {

        BasicHttpSecurityMode securityMode = BasicHttpSecurityMode.None;

  

        // Enable transport security when the URI points to a SSL-enabled location

        if (address.Scheme.ToLower() == "https")

        {

            securityMode = BasicHttpSecurityMode.Transport;

        }

  

        return new BasicHttpBinding(securityMode);

    }

  

    #endregion

}

The idea behind this class is that you can ask it for a service and it will create a binding and configure the address based on whether the Silverlight application is accessed over SSL or not. This makes it possible to deploy the website with the Silverlight application anywhere, without having to do a whole lot of configuration in each environment you drop the application in.

Building an authentication frontend service

You will need to follow a three-step process authenticate a user inside the Silverlight application. The first step is to actually authenticate the user. This is done by calling the authentication service on the website. If this operation succeeds and the user is authenticated you can call the role service to retrieve the roles of the user and the profile service to retrieve the profile properties of the user. The last two calls can be made in parallel to save some time on the login process.

It’s a good idea to encapsulate this process in a single component in the frontend. Because of the fact that all these service calls have to be made asynchronously and the code to do this can be quite complex.

       1: /// <summary>

       2: /// Implementation of the authentication frontend service

       3: /// </summary>

       4: public class Authentication: IAuthentication

       5: {

       6:     #region Private fields

       7:  

       8:     private AuthenticationServiceClient _authenticationServiceProxy;

       9:     private ProfileServiceClient _profileServiceProxy;

    private RoleServiceClient _roleServiceProxy;

  

    #endregion

  

    #region Constructors

  

    /// <summary>

    /// Initializes a new instance of the Authentication class.

    /// </summary>

    public Authentication()

    {

        _authenticationServiceProxy = ServiceFactory.CreateAuthenticationClient();

        _profileServiceProxy = ServiceFactory.CreateProfileClient();

        _roleServiceProxy = ServiceFactory.CreateRoleServiceClient();

    }

  

    #endregion

  

    #region Public events

  

    /// <summary>

    /// Occurs when the authentication operation is completed

    /// </summary>

    public event EventHandler<AsyncOperationCompletedEventArgs<bool>> AuthenticateCompleted;

    

    #endregion

  

    #region Public methods

  

    /// <summary>

    /// Begins to authenticate the user

    /// </summary>

    /// <param name="userName">User name of the user</param>

    /// <param name="password">Password of the user</param>

    public void BeginAuthenticate(string userName, string password)

    {

        //TODO: Call first service here

    }

  

    #endregion

}

The authentication class shown in the codesnippet is a very large class and as such it’s not completedly printed here. There are however a few specifics that I would like to share, because these can help you prevent nasty threading issues in Silverlight when doing these kinds of service calls.

Starting the authentication process

The first step in the authentication process is the actual authentication and establishes a server-side identity. Once this is identity is established the process should call two other services to gather all the data required by the Silverlight application.

The easiest way to build this would be to Invoke the next service from the callback that is performed when the first service call completes. This however causes a really nasty bug in the threading mechanics of Silverlight.

The threading stuff that was used by the first service call doesn’t get cleaned up immediately, but rather after the final call in the chain has been completed. The effect of this is that your frontend will tend to hang up on itself. Animations start to stutter and the application may become unresponsive due to the large amounts of locks and threads that are active in the Silverlight application.

To resolve this issue you should chain service calls by queuing the next service call on the threadpool, rather than invoking it directly. This gives Silverlight the chance to clean up after itself, before performing the next service call(s).

       1: /// <summary>

       2: /// Implementation of the authentication service

       3: /// </summary>

       4: public class Authentication : IAuthentication

       5: {

       6:  

       7:     #region Private fields

       8:  

       9:     private AuthenticationServiceClient _authenticationServiceProxy;

    private ProfileServiceClient _profileServiceProxy;

    private RoleServiceClient _roleServiceProxy;

  

    #endregion

  

    #region Constructors

  

    /// <summary>

    /// Initializes a new instance of the Authentication class.

    /// </summary>

    public Authentication()

    {

        _authenticationServiceProxy = ServiceFactory.CreateAuthenticationClient();

        _profileServiceProxy = ServiceFactory.CreateProfileClient();

        _roleServiceProxy = ServiceFactory.CreateRoleServiceClient();

    }

  

    #endregion

  

    #region Public events

  

    /// <summary>

    /// Occurs when the authentication operation is completed

    /// </summary>

    public event EventHandler<AsyncOperationCompletedEventArgs<bool>> AuthenticateCompleted;

  

    #endregion

  

    #region Public methods

  

    /// <summary>

    /// Begins to authenticate the user

    /// </summary>

    /// <param name="userName">User name of the user</param>

    /// <param name="password">Password of the user</param>

    public void BeginAuthenticate(string userName, string password)

    {

        _authenticationServiceProxy.LoginCompleted += OnLoginCompleted;

        _authenticationServiceProxy.LoginAsync(userName, password, "forms", false, new LoginData());

    }

  

    #endregion

  

    #region Private methods

  

    /// <summary>

    /// Handles the LoginCompleted event of the authentication service client

    /// </summary>

    /// <param name="sender"></param>

    /// <param name="e"></param>

    private void OnLoginCompleted(object sender, LoginCompletedEventArgs e)

    {

        _authenticationServiceProxy.LoginCompleted -= OnLoginCompleted;

  

        // Abort the authenticate operation if there's a problem

        if (e.Error != null)

        {

            OnAuthenticateCompleted(e.Error, false);

            return;

        }

  

        // Retrieve the user details after the login operation is completed successfully

        if (e.Result)

        {

            LoginData data = (LoginData)e.UserState;

            ThreadPool.QueueUserWorkItem(state => BeginGetRoles(data));

        }

    }

  

    /// <summary>

    /// Begins to retrieve the roles of the user

    /// </summary>

    /// <param name="data"></param>

    private void BeginGetRoles(LoginData data)

    {

        _roleServiceProxy.GetRolesForCurrentUserCompleted += OnGetRolesForCurrentUserCompleted;

        _roleServiceProxy.GetRolesForCurrentUserAsync(data);

    }

  

    /// <summary>

    /// Handles the GetRolesForCurrentUserCompleted event of the roles service

    /// </summary>

    /// <param name="sender"></param>

    /// <param name="e"></param>

    private void OnGetRolesForCurrentUserCompleted(object sender, GetRolesForCurrentUserCompletedEventArgs e)

    {

        // Abort the operation when retrieving the roles fails

        if (e.Error != null)

        {

            OnAuthenticateCompleted(e.Error, false);

            return;

        }

  

        LoginData data = (LoginData)e.UserState;

        data.Roles = e.Result;

  

        SecurityContext.Establish(data);

        OnAuthenticateCompleted(null, true);

    }

  

    /// <summary>

    /// Raises the AuthenticateCompleted event

    /// </summary>

    /// <param name="error"></param>

    /// <param name="success"></param>

    private void OnAuthenticateCompleted(Exception error, bool success)

    {

        var handler = AuthenticateCompleted;

  

        if (handler != null)

        {

            AsyncOperationCompletedEventArgs<bool> eventargs =

                new AsyncOperationCompletedEventArgs<bool>(error, success);

  

            Deployment.Current.Dispatcher.BeginInvoke(() => handler(this, eventargs));

        }

    }

  

    #endregion

}

Completing the authentication process

There are two parallel calls in the authentication components at the end of the authentication process. One is to retrieve the roles of the current user and the other is for retrieving the profile properties of the current user.

These two calls need to be completed before the authentication process is completed. The best way to do this is to have two wait handles that get signaled when the two webservice calls are completed. The following snippet demonstrates how you can build such a webservice call into your application:

       1: public class Authentication : IAuthentication, IDisposable

       2: {

       3:  

       4:     #region Private fields

       5:  

       6:     private AuthenticationServiceClient _authenticationServiceProxy;

       7:     private ProfileServiceClient _profileServiceProxy;

       8:     private RoleServiceClient _roleServiceProxy;

       9:     private ManualResetEvent _getRolesWaitHandle;

    private ManualResetEvent _getProfilePropertiesWaitHandle;

    private Exception _error;

  

    #endregion

  

    #region Constructors

  

    /// <summary>

    /// Initializes a new instance of the Authentication class.

    /// </summary>

    public Authentication()

    {

        _authenticationServiceProxy = ServiceFactory.CreateAuthenticationClient();

        _profileServiceProxy = ServiceFactory.CreateProfileClient();

        _roleServiceProxy = ServiceFactory.CreateRoleServiceClient();

  

        // Initialize the wait handles

        _getRolesWaitHandle = new ManualResetEvent(false);

        _getProfilePropertiesWaitHandle = new ManualResetEvent(false);

    }

  

    #endregion

  

    #region Public events

  

    /// <summary>

    /// Occurs when the authentication operation is completed

    /// </summary>

    public event EventHandler<AsyncOperationCompletedEventArgs<bool>> AuthenticateCompleted;

  

    #endregion

  

    #region Public methods

  

    /// <summary>

    /// Begins to authenticate the user

    /// </summary>

    /// <param name="userName">User name of the user</param>

    /// <param name="password">Password of the user</param>

    public void BeginAuthenticate(string userName, string password)

    {

        _authenticationServiceProxy.LoginCompleted += OnLoginCompleted;

        _authenticationServiceProxy.LoginAsync(userName, password, "forms", false, new LoginData());

    }

  

    #endregion

  

    #region Private methods

  

    /// <summary>

    /// Begins to retrieve the user profile properties

    /// </summary>

    /// <param name="data"></param>

    private void BeginGetUserDetails(LoginData data)

    {

        _profileServiceProxy.GetAllPropertiesForCurrentUserCompleted += OnGetPropertiesForCurrentUserCompleted;

        _profileServiceProxy.GetAllPropertiesForCurrentUserAsync(true, data);

    }

  

    /// <summary>

    /// Begins to retrieve the roles of the user

    /// </summary>

    /// <param name="data"></param>

    private void BeginGetRoles(LoginData data)

    {

        _roleServiceProxy.GetRolesForCurrentUserCompleted += OnGetRolesForCurrentUserCompleted;

        _roleServiceProxy.GetRolesForCurrentUserAsync(data);

    }

  

    /// <summary>

    /// Handles the GetPropertiesForCurrentUserCompleted event of the profile service

    /// </summary>

    /// <param name="sender"></param>

    /// <param name="e"></param>

    private void OnGetPropertiesForCurrentUserCompleted(object sender, GetAllPropertiesForCurrentUserCompletedEventArgs e)

    {

        _profileServiceProxy.GetAllPropertiesForCurrentUserCompleted -= OnGetPropertiesForCurrentUserCompleted;

  

        // Abort the operation when retrieving the profile properties fails

        if (e.Error != null)

        {

            _error = e.Error;

            _getProfilePropertiesWaitHandle.Set();

  

            return;

        }

  

        LoginData data = (LoginData)e.UserState;

        data.ProfileProperties = e.Result;

  

        _getProfilePropertiesWaitHandle.Set();

    }

  

    /// <summary>

    /// Handles the LoginCompleted event of the authentication service client

    /// </summary>

    /// <param name="sender"></param>

    /// <param name="e"></param>

    private void OnLoginCompleted(object sender, LoginCompletedEventArgs e)

    {

        _authenticationServiceProxy.LoginCompleted -= OnLoginCompleted;

  

        // Abort the authenticate operation if there's a problem

        if (e.Error != null)

        {

            OnAuthenticateCompleted(e.Error, false);

            return;

        }

  

        // Retrieve the user details after the login operation is completed successfully

        if (e.Result)

        {

            LoginData data = (LoginData)e.UserState;

  

            // Create the completion thread that is going to wait for the next two calls to complete

            Thread completionThread = new Thread(CompleteAuthenticationProcess);

            completionThread.Start();

  

            // Queue the next two calls

            ThreadPool.QueueUserWorkItem(state => BeginGetUserDetails(data));

            ThreadPool.QueueUserWorkItem(state => BeginGetRoles(data));

        }

    }

  

    // ... Other methods

  

    #endregion

  

    #region IDisposable members

  

    /// <summary>

    /// Disposes any unmanaged resources

    /// </summary>

    public void Dispose()

    {

        Dispose(true);

        GC.SuppressFinalize(this);

    }

  

    /// <summary>

    /// Disposes any the unmanaged resources used

    /// </summary>

    /// <param name="disposing"></param>

    protected virtual void Dispose(bool disposing)

    {

        if (disposing)

        {

            ((IDisposable)_getRolesWaitHandle).Dispose();

            ((IDisposable)_getProfilePropertiesWaitHandle).Dispose();

  

            _getProfilePropertiesWaitHandle = null;

            _getRolesWaitHandle = null;

        }

    }

  

    #endregion        

}

To make the solution complete, there should be a third thread in the application that should wait for these two wait handles and only continue when these two handles have been set. When the two handles have been set it should complete the authentication process by building a principal and raise the completed event. The following sample shows the last step for synchronizing two webservice calls:

       1: /// <summary>

       2: /// Completes the authentication process

       3: /// </summary>

       4: private void CompleteAuthenticationProcess()

       5: {

       6:     WaitHandle.WaitAll(new WaitHandle[] 

       7:     {

       8:         _getProfilePropertiesWaitHandle,

       9:         _getRolesWaitHandle

    });

  

    // If this thread can complete the authentication step was succesfull.

    // There could however be other problems, hence the error variable.

    OnAuthenticateCompleted(_error, true);

}

  

/// <summary>

/// Raises the AuthenticateCompleted event

/// </summary>

/// <param name="error"></param>

/// <param name="success"></param>

private void OnAuthenticateCompleted(Exception error, bool success)

{

    var handler = AuthenticateCompleted;

  

    if (handler != null)

    {

        AsyncOperationCompletedEventArgs<bool> eventargs =

            new AsyncOperationCompletedEventArgs<bool>(error, success);

  

        Deployment.Current.Dispatcher.BeginInvoke(() => handler(this, eventargs));

    }

}

The SecurityContext class

When the AuthenticateCompleted event is raised you can build a custom principal based on the authentication data gathered by the authentication frontend service.

I’ve created a specialized class for converting authentication data into a principle Inside the TaskTracker application named SecurityContext. This component is responsible for keeping track of the principal and for setting up the necessary calls to initialize the security context of the application. The following snippet shows this class.

       1: /// <summary>

       2: /// Contains security information about the application

       3: /// </summary>

       4: public class SecurityContext

       5: {

       6:     #region Private fields

       7:  

       8:     private IPrincipal _currentPrincipal;

       9:     

    #endregion

  

    #region Constructors

  

    /// <summary>

    /// Initializes a new instance of <see cref="SecurityContext"/>

    /// </summary>

    /// <param name="data"></param>

    public SecurityContext(LoginData data)

    {

        _currentPrincipal = new TaskTrackerPrincipal(data);

    }

  

    #endregion

  

    #region Singleton mechanics

  

    private static object _lockHandle = new object();

    private static SecurityContext _currentContext;

  

    /// <summary>

    /// Gets the current security context

    /// </summary>

    public static SecurityContext Current

    {

        get

        {

            lock (_lockHandle)

            {

                return _currentContext;

            }

        }

    }

  

    /// <summary>

    /// Establishes a new login context

    /// </summary>

    /// <param name="data"></param>

    public static void Establish(LoginData data)

    {

        lock (_lockHandle)

        {

            _currentContext = new SecurityContext(data);

        }

    }

  

    #endregion

  

    #region Public properties

  

    /// <summary>

    /// Gets the current principal

    /// </summary>

    public IPrincipal Principal

    {

        get

        {

            return _currentPrincipal;

        }

    }

    

    #endregion

}

The principal and identity are created by implementing the IPrincipal and IIdentity interface that you may already know from the .NET Framework.

       1: /// <summary>

       2: /// Represents a tasktracker identity

       3: /// </summary>

       4: public class TaskTrackerIdentity: IIdentity

       5: {

       6:     #region Private fields

       7:  

       8:     private Dictionary<string, object> _profileProperties;

       9:     private string _name;

  

    #endregion

  

    #region Constructor

  

    /// <summary>

    /// Initializes a new instance of the TaskTrackerIdentity class.

    /// </summary>

    /// <param name="name"></param>

    /// <param name="profileProperties"></param>

    public TaskTrackerIdentity(string name, Dictionary<string, object> profileProperties)

    {

        _profileProperties = profileProperties;

        _name = name;

    }

  

    #endregion

  

    #region Public properties

  

    /// <summary>

    /// Gets the type of authentication used

    /// </summary>

    public string AuthenticationType

    {

        get { return "Forms"; }

    }

  

    /// <summary>

    /// Gets whether this user is authenticated

    /// </summary>

    public bool IsAuthenticated

    {

        get { return true; }

    }

  

    /// <summary>

    /// Gets the name of the identity

    /// </summary>

    public string Name

    {

        get { return _name; }

    }

  

    #endregion

}

  

/// <summary>

/// Custom task tracker principal

/// </summary>

public class TaskTrackerPrincipal: IPrincipal

{

    #region Private fields

  

    private TaskTrackerIdentity _identity;

    private IEnumerable<string> _roles;

  

    #endregion

  

    #region Constructors

  

    /// <summary>

    /// Initializes a new instance of the TaskTrackerPrincipal class.

    /// </summary>

    public TaskTrackerPrincipal(LoginData data)

    {

        _roles = data.Roles;

        _identity = new TaskTrackerIdentity(data.UserName, data.ProfileProperties);

    }

  

    #endregion

  

    #region Public methods

  

    /// <summary>

    /// Validates if this principal is in a particular role

    /// </summary>

    /// <param name="role"></param>

    /// <returns></returns>

    public bool IsInRole(string role)

    {

        return _roles.Contains(role);

    }

    

    #endregion

  

    #region Public properties

  

    /// <summary>

    /// Gets the identity of the principal

    /// </summary>

    public IIdentity Identity

    {

        get { return _identity; }

    }

  

    #endregion

}

Security considerations

It’s important to know that while the application in principal is now secured through the use of the ASP.NET authentication service and role service, it’s important to pay extra attention some of the security aspects of the application.

SSL connections

Because this solution uses forms authentication all passwords are transferred in plain text towards the server. The use of a SSL connection is mandatory to eliminate the possibility for a hacker to capture passwords that are transmitted to the server.

Larger attack surface of application platform services

With the ASP.NET application services exposed as WCF services there’s a larger attack surface that hackers can use to attack your application. Setting up a working remote-access policy file for Silverlight is important to prevent abuse by unauthorized Silverlight and Flash applications that try to access the services.

It’s also a good idea to enable the least amount of services possible. For example, leave the profile service disabled if you don’t need it. This saves you a whole lot of trouble in the long run.

Conclusion

The application services offered by ASP.NET greatly help the development of secure Silverlight applications. This article explains how you can use the application services in a plain vanilla Silverlight application. They are however also available to developers working with WCF RIA services.

Creating Expression Blend 3 Silverlight triggers and actions

2010-03-02T17:21:18Z

In my previous post I introduced the behaviors model of Expression Blend. In this post I will show you a different technique for adding interactivity through the Expression Blend Designer by creating custom triggers and actions.

The difference between triggers and actions

Expression comes with two different base classes for the triggers and actions model. When you derive from the TriggerBase<T> class you’re telling the framework you want to trigger one or more actions based on a particular eventsource. This can be for example a timer or an event raised by the element the trigger is attached to.

If you derive from the TriggerAction<T> class you are telling the runtime that you want to perform a particular action based on a trigger.

TriggerAction instances are triggered by Trigger instances. You can have multiple triggers invoke the same action. Most of the time however you will be designing trigger actions and reuse the triggers offered to you by default.

Creating a custom trigger action

Creating your own trigger action is pretty straightforward. Just as with creating a custom behavior you will need two references:

System.Windows.Interactivity
Microsoft.Expression.Interactions

With these references added to the project you can create a new class that derives from TriggerAction<T>:

        1: /// <summary>

       2: /// Action that executes a command when triggered

       3: /// </summary>

       4: public class ExecuteCommandAction : TriggerAction<FrameworkElement>

       5: {

       6:     #region Protected methods

       7:  

       8:     /// <summary>

       9:     /// Invokes the action

      10:     /// </summary>

      11:     /// <param name="parameter"></param>

      12:     protected override void Invoke(object parameter)

      13:     {

      14:         //TODO: Add custom logic here

      15:     }

      16:  

      17:     #endregion

      18: }

Once you have the basic skeleton up, you can start implementing custom logic that should be executed when the trigger goes off. The sample trigger will be invoking a command that can be assigned to the trigger action by making use of the databinding possibilities offered by Silverlight.

       1: /// <summary>

       2: /// Invokes the command associated with the trigger

       3: /// </summary>

       4: /// <param name="parameter"></param>

       5: protected override void Invoke(object parameter)

       6: {

       7:     Command.Execute(parameter);

       8: }

When dropped onto the designer you will be able to select the trigger and configure it using the properties window in Expression Blend.

Creating your own triggers

When the default triggers aren’t enough for you, there’s always the option of creating a custom trigger. To make a custom trigger you should create a class that derives from TriggerBase<T> and implement the OnAttach and OnDetach method. You can use these two methods to link/unlink the trigger to/from the element that is associated with the trigger.

       1: /// <summary>

       2: /// Custom trigger implementation

       3: /// </summary>

       4: public class MySpecialTrigger: TriggerBase<FrameworkElement>

       5: {

       6:     /// <summary>

       7:     /// Invoked after the trigger is attached to the associated element

       8:     /// </summary>

       9:     protected override void OnAttached()

      10:     {

      11:         base.OnAttached();

      12:     }

      13:  

      14:     /// <summary>

      15:     /// Invoked right before the trigger is detached from the associated element

      16:     /// </summary>

      17:     protected override void OnDetaching()

      18:     {

      19:         base.OnDetaching();

      20:     }

      21: }

To make the trigger invoke actions, that might be using the trigger, you will need to use the InvokeActions(object o) method.

Final words

There’s loads more options available through the Expression Blend SDK and this post surely isn’t the last on this subject. Next stop: Custom designers and property value editors.