Silverlight 4 RIA services tutorial – Part 3

In this last part of this tutorial, we are going to discuss about how to deny or grant parts of our services based on authentication rules, for example, lets say that in the application that we have build throughout this tutorial, we would like to deny the non-authorized users the ability to add employees’ information. Open the application in Visual Studio and lets begin.

In the .Web project open the Services/EmployeesService.cs file. In this file we see all the functions-services provided to client applications using this service. In order to deny an unauthorized user to have access to a function we must add the [RequiresAuthentication] attribute before the function. If we want the users of a specific role to be granted a function we must add the [RequiresRole(“role”)] attribute, for example, if we want the “admins” to be granted a specific function, we add the [RequiresRole(“admins”)] attribute. For our purposes, we add the [RequiresAuthentication] attribute before the functions InsertEmployee, UpdateEmployee and DeleteEmployee. Now these functions should look like this:

        [RequiresAuthentication]
        public void InsertEmployee(Employee employee)
        {
            if ((employee.EntityState != EntityState.Detached))
            {
                this.ObjectContext.ObjectStateManager.ChangeObjectState(employee, EntityState.Added);
            }
            else
            {
                this.ObjectContext.Employees.AddObject(employee);
            }
        }

        [RequiresAuthentication]
        public void UpdateEmployee(Employee currentEmployee)
        {
            this.ObjectContext.Employees.AttachAsModified(currentEmployee, this.ChangeSet.GetOriginal(currentEmployee));
        }

        [RequiresAuthentication]
        public void DeleteEmployee(Employee employee)
        {
            if ((employee.EntityState == EntityState.Detached))
            {
                this.ObjectContext.Employees.Attach(employee);
            }
            this.ObjectContext.Employees.DeleteObject(employee);
        }

If you now try to add an employee without having logged in you will receive an error message.

Now, we must hide the “AddEmployee” page in the navigation bar if the current user has not logged in. To achieve this, open the MainPage.xaml.cs file and modify the constructor like this:

          public MainPage()
        {
            InitializeComponent();
            this.loginContainer.Child = new LoginStatus();

            Link3.Visibility = Visibility.Collapsed;
            Divider2.Visibility = Visibility.Collapsed;
            WebContext.Current.Authentication.LoggedIn += new EventHandler<AuthenticationEventArgs>(Authentication_LoggedIn);
            WebContext.Current.Authentication.LoggedOut += new EventHandler<AuthenticationEventArgs>(Authentication_LoggedOut);
        }

        private void Authentication_LoggedOut(object sender, AuthenticationEventArgs e)
        {
            if (WebContext.Current.User.IsAuthenticated == false)
            {
                Link3.Visibility = Visibility.Collapsed;
                Divider2.Visibility = Visibility.Collapsed;
            }
        }

        private void Authentication_LoggedIn(object sender, AuthenticationEventArgs e)
        {
            if (WebContext.Current.User.IsAuthenticated == true)
            {
                Link3.Visibility = Visibility.Visible;
                Divider2.Visibility = Visibility.Visible;
            }
        }

However, a user can still navigate to the AddEmployee page through the browser’s navigation bar, so there is one final thing to do in order to secure the page. Open the AddEmployee.xaml.cs file and modify the OnNavigatedTo so that it looks like this:

          protected override void OnNavigatedTo(NavigationEventArgs e)
        {
            if (WebContext.Current.User.IsAuthenticated == false)
                System.Windows.Browser.HtmlPage.Window.Navigate(new Uri("#/Home", UriKind.Relative));
        }

If you try now to navigate to the AddEmployee page without having logged in, it will redirect you to the Home page.

We now have a rich internet application with web services for assistance and secured, so this tutorial series has finally come to an end, i hope you like it !!