Security

The follow-up release of Code On Time introduces significant security enhancements to user identity validation performed when RSS , CSV, and live Microsoft Excel data feeds are generated.

The feeds are retrieved by external applications such as browsers, RSS readers, and Excel via a URL generated by application. User identity is not embedded into the data feed URLs.

These are the examples of the data feeds:

• RSS: http://dev.codeontime.com/demo/WebSiteFactory6/Export.ashx?q=eyJjb21tYW5kTmFtZSI6IkV4cG9ydFJzcyIsImNvbW1hbmRBcmd1bWVudCI6IiIsImNhdXNlc1ZhbGlkYXRpb24iOnRydWUsIkNvbnRyb2xsZXIiOiJDdXN0b21lcnMiLCJWaWV3IjoiZ3JpZDEiLCJGaWx0ZXIiOltdLCJTb3J0RXhwcmVzc2lvbiI6IiJ9
• Excel: http://dev.codeontime.com/demo/WebSiteFactory6/Export.ashx?q=eyJjb21tYW5kTmFtZSI6IkV4cG9ydFJvd3NldCIsImNvbW1hbmRBcmd1bWVudCI6IiIsImNhdXNlc1ZhbGlkYXRpb24iOnRydWUsIkNvbnRyb2xsZXIiOiJDdXN0b21lcnMiLCJWaWV3IjoiZ3JpZDEiLCJGaWx0ZXIiOltdLCJTb3J0RXhwcmVzc2lvbiI6IiJ9&d

Click on any of the links and you will be prompted to enter a name and password if your application is using ASP.NET Membership authentication. The application framework will detect access to data export resources and will request user name and password through Basic Authentication.

Enter the user name and password and the credentials will be authenticated against the ASP.NET Membership database. The URLs above will allow access to data if you enter admin / admin123% or user / user123% when prompted for username/password. These user accounts are registered on our demo server.

If you sign into the application at http://dev.codeontime.com/demo/websitefactory6 using one of the accounts listed above then try the following.

Live RSS Feed

Select the list of customers and choose Action | View RSS Feed option on the action bar.

The RSS feed will be presented.

Do not close the feed and return to the browser window with the application, click Logout link on the membership bar. You will be logged out and a fly-over login dialog will be displayed.

Return to the RSS feed and click Refresh button. You will be prompted to login via Basic Authentication.

Live Excel Spreadsheet

Select Export to Spreadsheet option from the action bar of the customer list.

The prompt to download an IQY file will be displayed. The file extension stands for “Internet Query” and is recognized by Microsoft Excel. Click Open button.

Microsoft Excel will start and will present an additional warning about security risks linked to the content that comes from Internet. We do know the source of data that we are downloading. The data itself is a simple XML data feed. Click Enable button.

Code On Time application will request the user identity. Enter one of the accounts that we have used above.

If the user name and password are matched to an ASP.NET Membership record then the data will be downloaded.

Use Excel to create dynamic and impactful business charts and refresh charts on-demand to see changes in the live data to reflect in your chart. You can email the spreadsheet to users in your organization. Users with valid application accounts will be able to refresh the data as well.

Conclusion

Business users can take full advantage of amazing data reporting and analytical capabilities available in Code On Time applications. Secure data feeds ensure safe shared environment.

Developers can create sophisticated virtual views that will utilize the user identity to filter the data accessible to the user.

Code On Time web application generator supports ASP.NET Membership and several other authentication mechanisms. ASP.NET Membership is an attractive option for Internet applications and can be also successfully used in intranet applications deployed within network boundaries of an organization for use by a specific group of business users.

Web application administrator can use the advanced user manager provided with each generated application to create user accounts and manage roles.

Large organizations frequently mandate the need for a single sign-on mechanism to eliminate the need to manage multiple passwords and users accounts.

1. Typically a user name token is created and validated by the authentication software deployed to the local network. The user name token is embedded into each web request coming to a server. The authenticated user name can be found in a page request header variable.
2. Another option is to use the active directory identity name that can be available if Windows Authentication is enabled in your web application.

You can take advantage of either option to implement a mixed authentication based on ASP.NET Membership option available in Code On Time database web application. Only the users registered in the ASP.NET Membership database of your application can access the application.  User roles will also be derived from the membership database.

Users can self-registered to use the application and  will be able to access the application page when the user account is approved by administrator. Administrator can also create all authorized user accounts and assign the same “secret” password to all user.

Single sign-on is enabled through changes to the login user control. Open file ~/App_Code/Controls/Login.ascx and modify the code-behind file as shown below.

C#:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.Security;
using System.Security.Principal;

public partial class Controls_Login : System.Web.UI.UserControl
{
    
    protected void Page_Load(object sender, EventArgs e)
    {
         // Mixed authentication sample
        if (!Page.User.Identity.IsAuthenticated)
        {
            string userName = null;
            // 1. read the identity from the page request header variable
            userName = Request.Headers["UserName"];
            // 2. read the identity from the identity of the current Windows user
            userName = WindowsIdentity.GetCurrent().Name;
            // simulate the user name and ignore methods (1) and (2)
            userName = "admin";
            if (!String.IsNullOrEmpty(userName))
            {
                MembershipUser user = Membership.GetUser(userName);
                if (user != null)
                    FormsAuthentication.RedirectFromLoginPage(user.UserName, false);
            }
        }
    }
}

Methods of “silent” authentication are marked as (1) and (2). This particular example ignores the obtained information and simply assigns explicitly the user name “admin” to variable “userName”.  Application makes a lookup request to identify the user as a valid ASP.NET Membership user. If that is the case then the user is automatically signed into the web application.

The login control is generated the first time only. Your changes to the code-behind file will stay intact with subsequent code generations.

Adjust the sample to reflect your actual single sign-on method.