Για roleBased Security ρίξε μία ματία στο Namespace System.Security.Principal
Παρακάτω σου δίνω μία απλή υλοποίηση με την χρήση GenericIdentity & GenericPrincipal.
Για να κάνεις LogIn :
Authendication.Login(Me.UsernameTextBox.Text, Me.PasswordTextBox.Text)
Για να ελέγξεις αν κάποιος χρήστης έχει κάνει Login :
Thread.CurrentPrincipal.Identity.IsAuthenticated
Για να επιστρέψεις δεδομένα κάποιου χρήστη:
sqlCommand.Parameters.AddWithValue("@UserName", Thread.CurrentPrincipal.Identity.Name)
sqlCommand.CommandText="Select * from SomeTable where UserName=@UserName"
Για να ελέγξεις αν ο χρήστης ανήκει σε κάποιο role :
Thread.CurrentPrincipal.IsInRole ("SomeRoleLikeCanEditCustomer"))
Sample code:
Φτιάξε στην Βάση δεδομένων σου τους παρακάτω 2 πίνακες :
CREATE TABLE [dbo].[User](
[UserName] [nvarchar](20) NOT NULL,
[Password] [nvarchar](20) NOT NULL,
CONSTRAINT [PK_User] PRIMARY KEY CLUSTERED
(
[UserName] ASC
)
) ON [PRIMARY]
GO
CREATE TABLE [dbo].[UserRole](
[Role] [nchar](64) NOT NULL,
[UserName] [nvarchar](20) NOT NULL,
CONSTRAINT [PK_UserRole] PRIMARY KEY CLUSTERED
(
[Role] ASC,
[UserName] ASC
)
) ON [PRIMARY]
GO
ALTER TABLE [dbo].[UserRole] WITH CHECK ADD CONSTRAINT [FK_UserRole_User] FOREIGN KEY([UserName])
REFERENCES [dbo].[User] ([UserName])
ON UPDATE CASCADE
ON DELETE CASCADE
GO
ALTER TABLE [dbo].[UserRole] CHECK CONSTRAINT [FK_UserRole_User]
GO
Φτιάξε ένα stored procedure που θα χρησιμοποιείς για να κάνεις Login.
Create PROCEDURE [dbo].[Login]
(
@UserName nvarchar(20),
@Password nvarchar(20)
)
AS
SELECT u.UserName FROM [User] u WHERE u.UserName=@UserName and u.Password=@Password;
SELECT r.[Role],r.[UserName] FROM [UserRole] r WHERE r.UserName=@UserName;
χρησιμοποίησε κώδικα όπως παρακάτω για να κάνεις LogIn:
Imports System.Security.Principal
Imports System.Threading
Public Class Authendication
Public Shared Function IsAuthenticated() As Boolean
Return Thread.CurrentPrincipal.Identity.IsAuthenticated
End Function
Public Shared Sub Login(ByVal userName As String, ByVal password As String)
Dim cnn As SqlClient.SqlConnection = Nothing
Dim cmd As SqlClient.SqlCommand = Nothing
Dim rdr As SqlClient.SqlDataReader = Nothing
Dim identity As GenericIdentity = Nothing
Dim principal As GenericPrincipal = Nothing
Dim roles As List(Of String) = Nothing
Try
cnn = New SqlClient.SqlConnection(My.Settings.connectionString)
cmd = cnn.CreateCommand
With cmd
.CommandType = CommandType.StoredProcedure
.CommandText = "Login"
.Parameters.AddWithValue("@UserName", userName)
.Parameters.AddWithValue("@Password", password)
End With
cnn.Open()
rdr = cmd.ExecuteReader
While rdr.Read
If Not rdr(0) Is System.DBNull.Value Then
identity = New GenericIdentity(rdr(0))
End If
End While
If identity Is Nothing Then
Thread.CurrentPrincipal = Nothing
Exit Sub
End If
roles = New List(Of String)
If rdr.NextResult Then
While rdr.Read
roles.Add(rdr("Role"))
End While
End If
principal = New GenericPrincipal(identity, roles.ToArray)
Thread.CurrentPrincipal = principal
Catch ex As Exception
Throw ex
Finally
cnn.Close()
End Try
End Sub
End Class
Μπλουγουράς Γιάννης
Wizcom O.E.