I.T. Discussion Community!
-Collapse +Expand
Search C# Group:

-Collapse +Expand C# To/From
-Collapse +Expand C# Study Test
-Collapse +Expand C# Store

Prestwood eMagazine

August Edition
Subscribe now! It's Free!
Enter your email:

   ► KBProgrammingC#WebForms Cod...   Print This    All Groups  
  From the October 2015 Issue of Prestwood eMag
C# WebForms Coding Tasks:
Using GenericIdentity for Cross Platform Authentication in the .NET framework
Posted 11 years ago on 11/2/2009
Take Away:

When designing a WinForms application, the most straightforward way to authenticate a user is using NTLM or Active Directory using WindowsIdentity.GetCurrent. Over the Internet, you can use the whole ASP.Net security setup with Membership.GetUser. The GenericPrincipal object works well when you deploy to a mixed web/WinForms environment. See new GenericIdentity.


Let me say from the beginning that this should be a lot easier.

Basic Authentication

When designing a WinForms application, the most straightforward way to authenticate a user is using NTLM or Active Directory... It's built right into the OS and you don't need to deal with password dialogs and lost password questions at all - just ask Windows who the user is, like this...

using System.Security.Principal; 
WindowsIdentity windowsIdentity = WindowsIdentity.GetCurrent();

That was easy... now how about using a web application?  That gets a little more complicated.  If the user is coming in over the intranet, then IIS knows who it is, but if they are accessing your site over the internet, it uses the whole aspnet security setup to create users and roles and permissions.  This is very easy to use as well, and for the most part requires no coding at all - but if you need to retrieve the name of the authenticated user, you would use something like this...

using System.Web.Security; 
MembershipUser User = Membership.GetUser();
roles = System.Web.Security.Roles.GetRolesForUser();

What is a GenericPrincipal?

That explains the identity object, but what is a GenericPrincipal?

As far as I can tell the Generic principal's only use is to contain both a GenericIdentity object, and a list of roles assigned to that identity.  So think of it as a baggie with an ID card and a ring of keys (roles/permissions).

Rolling Your Own

What if you need a robust set of libraries that can access identity information regardless of the data source?  Thats where the GenericIdentity and GenericPrincipal objects come into play.

More Info:

For deployment into a mixed web/winforms environment, these components are very useful as they can migrate without regard to the source of the user and role data.

Creating a Generic Identity


string userName = "somebody";
GenericIdentity authenticatedGenericIdentity = new
                              GenericIdentity(userName, "Database");

...from Windows

WindowsIdentity windowsIdentity = WindowsIdentity.GetCurrent();
string authenticationType = windowsIdentity.AuthenticationType;
string userName = windowsIdentity.Name;
GenericIdentity authenticatedGenericIdentity = new GenericIdentity(userName, authenticationType);

...from a database

string connectionstring = @"Data Source=.\SQLExpress;
Initial Catalog=PermsLib;Integrated Security=True";
SqlConnection MyConn = new SqlConnection(connectionstring);

SqlCommand Query1 = new SqlCommand(@"Select * from logins where username=@user
    and password=@pwd and account_locked=0;", MyConn);
Query1.Parameters.AddWithValue("@user", username);
Query1.Parameters.AddWithValue("@pwd", password);

SqlDataReader myReader = Query1.ExecuteReader();

if (myReader.HasRows)
string userName = username;
GenericIdentity authenticatedGenericIdentity = new GenericIdentity(userName, "Database");
return authenticatedGenericIdentity;
} else {
throw new System.Security.SecurityException("invalid user");

The great thing is that you can toss these objects around in a mixed application, and they will travel nicely from place to place.


Share a thought or comment...
Write a Comment...
Sign in...

If you are a member, Sign In. Or, you can Create a Free account now.

Anonymous Post (text-only, no HTML):

Enter your name and security key.

Your Name:
Security key = P1135A1
Enter key:
KB Post Contributed By Bryan Valencia:

Bryan Valencia is the author of millions of lines of code and writes for PrestwoodBoards and Visual Studio Journey on-line magazines.

Visit Profile

 KB Article #102068 Counter
Since 11/2/2009

Follow PrestwoodBoards on: 

©1995-2020 PrestwoodBoards  [Security & Privacy]
Professional IT Services: Coding | Websites | Computer Tech