winforms authentication

[Angelo[B]]

Hi there, I have to implement winforms authentication on my little
document management tool.
The must implement authentication 2 kinds:

1) simple user and pwd authentication with these information stored
into its databse
2) winforms authentication:
- local if the apllication will run in a stand-alone machine
- networl if the application will run on an Active Directory Domain

I need resource, patterns and best-practise that talk abput the second
scenario.

Can you please help me?

 

[Pavel Minaev]

Hi there, I have to implement winforms authentication on my little
document management tool.
The must implement authentication 2 kinds:

1) simple user and pwd authentication with these information stored
into its databse
2) winforms authentication:
   - local if the apllication will run in a stand-alone machine
   - networl if the application will run on an Active Directory Domain

I need resource, patterns and best-practise that talk abput the second
scenario.

What is "WinForms authentication", even? I am not aware of any such.

 

[Angelo[B]]

What is "WinForms authentication", even? I am not aware of any such.

I mean, authentication for desktop application, not web application.

 

[Pavel Minaev]

I mean, authentication for desktop application, not web application.

To break this and your previous post down, you need to authenticate in
a WinForms application against:

1. Your own backend for storing user credentials.
2. Local Windows user accounts.
3. Domain Windows user accounts.

The latter two are really the same, since, if you use built-in Windows
functionality for that, it will transparently do the right thing (note
that for case #3, even if the machine is part of a domain, it can
still have some local accounts, and it will authenticate against them,
too).

The first one should be pretty obvious - keep a database of logins and
password hashes (don't forget about the salt!), have a form to input
those, validate against the database.

For Windows authentication, it depends on what you're actually trying
to do. Keep in mind that any Windows process is already running under
the account (and privileges) of the user who started it. Usually,
that's really all you need; i.e., if the user logged into the system
and ran your application, then he had the rights to do so.
Furthermore, since everything the application does will also be done
under that user's identity, you can just assign appropriate
permissions to all resources (files, databases etc) that the
application uses.

If you actually need to force your application (or some parts of it)
to run in the context of a different user account, then you'll need to
prompt for username/password, use WinAPI LogonUser function to log in
using the supplied credentials, and then impersonate the logged-in
user. Here is a blog post that explains how to do that:
http://mikehadlow.blogspot.com/2007/01/easy-impersonation.html

If you just need to validate whether the user is who he says he is or
not, without impersonating him (if you do, then you should really ask
yourself why you're doing that... security-wise this is a rather
suspicious thing), then you can still use LogonUser, but only to check
if it's successful or not, immediately disposing of the returned token
after the call.

 

[Angelo[B]]

If you just need to validate whether the user is who he says he is or

not, without impersonating him (if you do, then you should really ask
yourself why you're doing that... security-wise this is a rather
suspicious thing), then you can still use LogonUser, but only to check
if it's successful or not, immediately disposing of the returned token
after the call.

Thak you for the effective reply. It strike my need.

I am building a simple document management application.
When the user run tha application, I have to ask user and password to
be sure of the users identity,
Just to avoid that other people do strange things.

So I think that I will simply request to confirm user and password to
provide access to the application.

 

[J.B. Moreno]

Thak you for the effective reply. It strike my need.

I am building a simple document management application.
When the user run tha application, I have to ask user and password to
be sure of the users identity,

You already know the users identity -- it's inherent in the system. To
use the computer you have to login, when you login the system knows who
you are.

The exception to this is when the user walks away from the computer
after logging in without locking the computer. But thats not a
scenario that you should give any consideration, because there's
nothing to keep them from logging into the computer, logging into your
application, and then walking away without locking the computer down.