User Login & Application Security

[Patrick Blackman]

Hi, need some info on implementing a multiuser winforms application,
specifically managing user logins and user preferences & access rights. Are
there any frameworks out there for this. I don't want to use windows
identity system. Any pointers would be appreciated.

[russ.haley@gmail.com]

Re: User Login & Application Security

For simple preferences you could use a combination of

Application.Use rAppDataPath
..UserAppDataRe gistry
..CommonAppData Path
..CommonAppData Registry

Not sure how to do it off the top of my head, but I'm sure if you just
needed to check for admin rights to the computer you could make a quick
check to the current identity.

Are you looking for something complex like LDAP or just authentication
against a database? If you just need to authenticate the one
application (i.e. one computer, one set of security settings), you
could imbed SQLite and create a small security/preference system that
gets installed with the application. http://www.sqlite.org/. For the
..net ADO wrapper go to http://adodotnetsqlite.sourceforge.net/. The
SQLite documentation has a link for a wrapper that works with .net 2.0

If your not going to tie things down using microsoft security I'd
suggest just creating your own classes and using a hash to protect the
password. Encode the password as an MD5 hash in the database. When the
user types the password, just MD5 the string and send the MD5 for
comparison. This is totally breakable but at least protects the
password from being read by a human. In the case of SQLite everything
is executed in the current security so nobody could sniff the
communicaitons. A simple class library with groups, users and
permissions is pretty easy to implement.

Not sure why you don't want to use Identities? I linked ASP.Net forms
to a GenericIdentity and created a data access layer for authentication
against a database. Was able to swap out Sybase SQL Anywhere for SQL
Server relatively painlessly.

Cheers
Russ

[Patrick Blackman]

Re: User Login & Application Security

Thanks..good advice, will check it out....
<russ.haley@gma il.com> wrote in message
news:1140067060 .783359.201050@ o13g2000cwo.goo glegroups.com.. .[color=blue]
> For simple preferences you could use a combination of
>
> Application.Use rAppDataPath
> .UserAppDataReg istry
> .CommonAppDataP ath
> .CommonAppDataR egistry
>
> Not sure how to do it off the top of my head, but I'm sure if you just
> needed to check for admin rights to the computer you could make a quick
> check to the current identity.
>
> Are you looking for something complex like LDAP or just authentication
> against a database? If you just need to authenticate the one
> application (i.e. one computer, one set of security settings), you
> could imbed SQLite and create a small security/preference system that
> gets installed with the application. http://www.sqlite.org/. For the
> .net ADO wrapper go to http://adodotnetsqlite.sourceforge.net/. The
> SQLite documentation has a link for a wrapper that works with .net 2.0
>
> If your not going to tie things down using microsoft security I'd
> suggest just creating your own classes and using a hash to protect the
> password. Encode the password as an MD5 hash in the database. When the
> user types the password, just MD5 the string and send the MD5 for
> comparison. This is totally breakable but at least protects the
> password from being read by a human. In the case of SQLite everything
> is executed in the current security so nobody could sniff the
> communicaitons. A simple class library with groups, users and
> permissions is pretty easy to implement.
>
> Not sure why you don't want to use Identities? I linked ASP.Net forms
> to a GenericIdentity and created a data access layer for authentication
> against a database. Was able to swap out Sybase SQL Anywhere for SQL
> Server relatively painlessly.
>
> Cheers
> Russ
>[/color]