locked
How to handle Security Exception RRS feed

  • Question

  • Hi

    I am using some mechanism to manage the UserControl/views  from WPF main window:

    class Switcher
        {
            public static MainWindow pageSwitcher;
            public static void Switch(UserControl newPage)
            {
                pageSwitcher.Navigate(newPage);
            }   
        }
    
    public partial class MainWindow
        {       
           public MainWindow()
           {
                InitializeComponent();
                Switcher.pageSwitcher = this;
                Switcher.Switch(new Login());
           }
    
           public void Navigate(UserControl nextPage)
           {
                this.contentControl.Content = nextPage;
           }
        }

    Now whenever I want to switch the View I use below code:

    Switcher.Switch(new Home());

    But now issue is my Home UserControl class is something like this:

    [PrincipalPermission(SecurityAction.Demand, Role = "User")]
    public partial class Home : UserControl
    {  }
     

    As explained HERE implementing custom authentication and authorization.

    Now whenever I am trying to switch the view I have to create new instance of User Control Class like "new Home()" but if user don’t have permissions on the Home page then I get security exception.

    My question is that, is there any way where I can handle this Security Exception in Switcher class? If so then will be able to create separate error page which will get displayed if user doesn't have permissions.

    Please suggest.

    Thanks in advance.



    Thursday, February 4, 2016 2:13 PM

Answers

  • You're applying security on the Home view?

    I don't really follow why you would do that.

    If they can run the app at all then shouldn't they get to see home?

    .

    The way to control this sort of thing is to just hide buttons ( or whatever ) that the user would use to navigate to views they should not be able to use.

    Once they've decided to navigate then it's too late.

    In fact the whole idea of raising a security exception if they navigate to a view is a bit strange.

    Don't give them the button and they can't navigate at all.

    .

    Most of my apps use active directory roles to decide what people can do.

    There is no sign in.

    The most basic mechanism is to give everyone most views and only people who are in an admin  role for the app see an admin sub menu.

    And that's it.

    Clients hate extra sign ins.

    Users hate extra passwords.

    Managers hate maintaining yet another set of roles, users and passwords.

    Unless you really have no alternative then groups and isinrole is the way to go.


    Hope that helps.

    Technet articles: WPF: Layout Lab; All my Technet Articles

    Thursday, February 4, 2016 3:21 PM

All replies

  • You're applying security on the Home view?

    I don't really follow why you would do that.

    If they can run the app at all then shouldn't they get to see home?

    .

    The way to control this sort of thing is to just hide buttons ( or whatever ) that the user would use to navigate to views they should not be able to use.

    Once they've decided to navigate then it's too late.

    In fact the whole idea of raising a security exception if they navigate to a view is a bit strange.

    Don't give them the button and they can't navigate at all.

    .

    Most of my apps use active directory roles to decide what people can do.

    There is no sign in.

    The most basic mechanism is to give everyone most views and only people who are in an admin  role for the app see an admin sub menu.

    And that's it.

    Clients hate extra sign ins.

    Users hate extra passwords.

    Managers hate maintaining yet another set of roles, users and passwords.

    Unless you really have no alternative then groups and isinrole is the way to go.


    Hope that helps.

    Technet articles: WPF: Layout Lab; All my Technet Articles

    Thursday, February 4, 2016 3:21 PM
  • You are right, security should not applied to Home page. But to ask a question have just randomly created that class on post.

    I agree with your thought that there should not be any way for user to go to the restricted pages. I should disable or invisible to navigation controls.

    Thanks for your valuable suggestion.

     


    Best Regards, Somnath

    Friday, February 5, 2016 6:32 AM