How to: Use the Integrated Mode of the Security System in Non-XAF Applications

• Feb 24, 2022
• 4 minutes to read

This topic demonstrates how to access data protected by the Security System (Integrated Mode) from a console application.

Note

A complete sample project is available at https://github.com/DevExpress-Examples/XAF_Security_E4908.

Refer to the following tutorials for more .NET Framework and .NET Core examples:

• DevExtreme + ASP.NET Web API OData
• WinForms
• ASP.NET WebForms
• ASP.NET Core MVC
• Blazor Server
• Console

Prerequisites

1. You have an XAF solution (for example, XafSolution) with the platform-agnostic module and WinForms or ASP.NET application projects.
2. This solution uses XPO as an ORM system.
3. The WinForms or ASP.NET application uses the Integrated Mode of the Security System and Standard authentication.
4. There is an active user with the “User” name and an empty password.
5. Business objects are defined in the XafSolution.Module project (for example, Employee and Department).
6. A database (XafSolution) is generated for these business objects.

Create and Configure a Non-XAF Application

1. Create a console application.

2. Add the following code to the application’s configuration file (App.config) to set a connection string.

   XML

   <?xml version="1.0" encoding="utf-8" ?>
   <configuration>
     <connectionStrings>
       <add name="ConnectionString" connectionString="Data Source=DBSERVER;Initial Catalog=XafSolution;Integrated Security=True"/>
     </connectionStrings>
     <!-- ... -->
   </configuration>
   

   Replace DBSERVER with a database server name or its IP address. For example, use localhost or (local) for a local database server.

3. Reference the following assemblies:

   • XafSolution.Module.dll
   • System.Configuration.dll
   • DevExpress.ExpressApp.v19.2.dll
   • DevExpress.ExpressApp.Security.v19.2.dll
   • DevExpress.ExpressApp.Security.Xpo.v19.2.dll
   • DevExpress.ExpressApp.Xpo.v19.2.dll
   • DevExpress.Persistent.BaseImpl.v19.2.dll

Access Secured Data

Perform the following steps in the console application’s Program.cs (Program.vb) file.

1. Initialize the Types Info System and use the RegisterEntity(Type) method to register the business objects that should be accessible in this application.

   C#

   using DevExpress.ExpressApp;
   using DevExpress.ExpressApp.Xpo;
   using DevExpress.Persistent.BaseImpl.PermissionPolicy;
   using XafSolution.Module.BusinessObjects;
   //...
   static void Main(string[] args) {
       RegisterEntities();
       // ...
   }
   private static void RegisterEntities()        {
       XpoTypesInfoHelper.GetXpoTypeInfoSource();
       XafTypesInfo.Instance.RegisterEntity(typeof(Employee));
       XafTypesInfo.Instance.RegisterEntity(typeof(Department));
       XafTypesInfo.Instance.RegisterEntity(typeof(PermissionPolicyUser));
       XafTypesInfo.Instance.RegisterEntity(typeof(PermissionPolicyRole));
   }
   

   VB.NET

   Imports DevExpress.ExpressApp
   Imports DevExpress.ExpressApp.Xpo
   Imports DevExpress.Persistent.BaseImpl.PermissionPolicy
   Imports XafSolution.Module.BusinessObjects
   '...
   Shared Sub Main(ByVal args() As String)
       RegisterEntities()
       ' ...
   End Sub
   Private Shared Sub RegisterEntities()
       XpoTypesInfoHelper.GetXpoTypeInfoSource()
       XafTypesInfo.Instance.RegisterEntity(GetType(Employee))
       XafTypesInfo.Instance.RegisterEntity(GetType(Department))
       XafTypesInfo.Instance.RegisterEntity(GetType(PermissionPolicyUser))
       XafTypesInfo.Instance.RegisterEntity(GetType(PermissionPolicyRole))
   End Sub
   

2. Initialize the Security System.

   C#

   using DevExpress.ExpressApp.Security;
   // ...
   AuthenticationStandard authentication = new AuthenticationStandard();
   SecurityStrategyComplex security = new SecurityStrategyComplex(typeof(PermissionPolicyUser), typeof(PermissionPolicyRole), authentication);
   security.RegisterXPOAdapterProviders();
   

   VB.NET

   Imports DevExpress.ExpressApp.Security
   ' ...
   Dim authentication As New AuthenticationStandard()
   Dim security As New SecurityStrategyComplex(GetType(PermissionPolicyUser), GetType(PermissionPolicyRole), authentication)
   security.RegisterXPOAdapterProviders()
   

3. Create the SecuredObjectSpaceProvider object. It allows you to logon and create SecuredObjectSpace to access secured data.

   C#

   using System.Configuration;
   using DevExpress.ExpressApp.Security.ClientServer;
   // ...
   string connectionString = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;
   SecuredObjectSpaceProvider objectSpaceProvider = new SecuredObjectSpaceProvider(security, connectionString, null);
   

   VB.NET

   Imports System.Configuration
   Imports DevExpress.ExpressApp.Security.ClientServer
   ' ...
   Dim connectionString As String = ConfigurationManager.ConnectionStrings("ConnectionString").ConnectionString
   Dim objectSpaceProvider As New SecuredObjectSpaceProvider(security, connectionString, Nothing)
   

4. Perform a logon.

   C#

   string userName = "User";
   string password = string.Empty;
   authentication.SetLogonParameters(new AuthenticationStandardLogonParameters(userName, password));
   IObjectSpace loginObjectSpace = objectSpaceProvider.CreateObjectSpace();
   security.Logon(loginObjectSpace);
   

   VB.NET

   Dim userName As String = "User"
   Dim password As String = String.Empty
   authentication.SetLogonParameters(New AuthenticationStandardLogonParameters(userName, password))
   Dim loginObjectSpace As IObjectSpace = objectSpaceProvider.CreateObjectSpace()
   security.Logon(loginObjectSpace)
   

5. Create the SecuredObjectSpace object to operate with secured data.

   C#

   using System.Text;
   // ...
   StringBuilder stringBuilder = new StringBuilder();
   stringBuilder.Append("List of the 'Employee' objects:\n");
   using(IObjectSpace securedObjectSpace = objectSpaceProvider.CreateObjectSpace()) {
       foreach(Employee employee in securedObjectSpace.GetObjects<Employee>()) {
           stringBuilder.Append(string.Format("Full name: {0}\n", employee.FullName));
           if(security.IsGranted(new PermissionRequest(securedObjectSpace, typeof(Employee), SecurityOperations.Read, employee, "Department"))) {
               stringBuilder.Append(string.Format("Department: {0}\n", employee.Department.Title));
           }
           else {
               stringBuilder.Append("Department: [Protected content]\n");
           }
       } 
   }
   

   VB.NET

   Imports System.Text
   ' ...
   Dim stringBuilder As New StringBuilder()
   stringBuilder.Append("List of the 'Employee' objects:" & vbLf)
   Using securedObjectSpace As IObjectSpace = objectSpaceProvider.CreateObjectSpace()
       For Each employee As Employee In securedObjectSpace.GetObjects(Of Employee)()
           stringBuilder.Append(String.Format("Full name: {0}" & vbLf, employee.FullName))
           If security.IsGranted(New PermissionRequest(securedObjectSpace, GetType(Employee), SecurityOperations.Read, employee, "Department")) Then
               stringBuilder.Append(String.Format("Department: {0}" & vbLf, employee.Department.Title))
           Else
               stringBuilder.Append("Department: [Protected content]" & vbLf)
           End If
       Next employee
       file.Write(stringBuilder)
   End Using
   

   If a user was not allowed to read a property, the Secured Object Space returns the property default value. Use the IsGranted(IPermissionRequest) method to display the “Protected content” placeholder instead of this value.

Important

Ensure that the static EnableRfc2898 and SupportLegacySha512 properties in your non-XAF application have the same values as those in the XAF application where the password was set. Otherwise, you will not be able to log in.