How to: Use the Integrated Mode of the Security System in Non-XAF Applications

• Feb 24, 2022
• 2 minutes to read

This topic demonstrates the code that you can use in any non-XAF application to access data protected by the Security System.

Tip

A complete sample project is available in the DevExpress Code Examples database at https://supportcenter.devexpress.com/ticket/details/e4908/net-role-based-access-control-user-authentication-api-for-devexpress-xpo-and-microsoft.

1. Initialize the Types Info system and register the business objects that you will access from your code.

   C#

   using DevExpress.ExpressApp;
   using DevExpress.Persistent.BaseImpl.PermissionPolicy;
   //...
   XpoTypesInfoHelper.GetXpoTypeInfoSource();
   XafTypesInfo.Instance.RegisterEntity(typeof(Person));
   XafTypesInfo.Instance.RegisterEntity(typeof(PermissionPolicyUser));
   XafTypesInfo.Instance.RegisterEntity(typeof(PermissionPolicyRole));
   

   VB.NET

   Imports DevExpress.ExpressApp
   Imports DevExpress.Persistent.BaseImpl.PermissionPolicy
   '...
   XpoTypesInfoHelper.GetXpoTypeInfoSource()
   XafTypesInfo.Instance.RegisterEntity(GetType(Person))
   XafTypesInfo.Instance.RegisterEntity(GetType(PermissionPolicyUser))
   XafTypesInfo.Instance.RegisterEntity(GetType(PermissionPolicyRole))
   

2. Create a non-secure Object Space by using an XPObjectSpaceProvider object. This Object Space is required for logon.

   C#

   string connectionString =
       "Integrated Security=SSPI;Pooling=false;Data Source=(local);Initial Catalog=MySolution";
   XPObjectSpaceProvider directProvider = new XPObjectSpaceProvider(connectionString, null);
   IObjectSpace directObjectSpace = directProvider.CreateObjectSpace();
   

   VB.NET

   Dim connectionString As String = _
   "Integrated Security=SSPI;Pooling=false;Data Source=(local);Initial Catalog=MySolution"
   Dim directProvider As New XPObjectSpaceProvider(connectionString, Nothing)
   Dim directObjectSpace As IObjectSpace = directProvider.CreateObjectSpace()
   

3. Initialize the Security System and perform a logon. The code below demonstrates how to do this as a user named “User” who has an empty password.

   C#

   AuthenticationStandard auth = new AuthenticationStandard();
   auth.SetLogonParameters(new AuthenticationStandardLogonParameters("User", ""));
   SecurityStrategyComplex security = new SecurityStrategyComplex(typeof(PermissionPolicyUser), typeof(PermissionPolicyRole), auth);
   SecuritySystem.SetInstance(security);
   security.Logon(directObjectSpace);
   

   VB.NET

   Dim auth As New AuthenticationStandard()
   auth.SetLogonParameters(New AuthenticationStandardLogonParameters("User", ""))
   Dim security As New SecurityStrategyComplex(GetType(PermissionPolicyUser), GetType(PermissionPolicyRole), auth)
   SecuritySystem.SetInstance(security)
   security.Logon(directObjectSpace)
   

4. Create a secure Object Space by using a SecuredObjectSpaceProvider object. This Object Space can be used for secure data access.

   C#

   SecuredObjectSpaceProvider osProvider = new SecuredObjectSpaceProvider(security, connectionString, null);
   IObjectSpace securedObjectSpace = osProvider.CreateObjectSpace();
   

   VB.NET

   Dim osProvider As New SecuredObjectSpaceProvider(security,  connectionString, Nothing)
   Dim securedObjectSpace As IObjectSpace = osProvider.CreateObjectSpace()
   

5. Now you can call the securedObjectSpace Object Space’s methods (e.g., IObjectSpace.GetObjects).

   C#

   foreach (Person person in securedObjectSpace.GetObjects<Person>()) {
        Console.WriteLine(person.FirstName);
   }
   

   VB.NET

   For Each person As Person In securedObjectSpace.GetObjects(Of Person)()
        Console.WriteLine(person.FirstName)
   Next person
   

   Note that only objects that the “User” user is allowed access will be printed with the code above. If you need to ignore security restrictions, use the non-secure directObjectSpace Object Space.