Web Dev Bros » .net http://www.webdevbros.net hot talk about web development Wed, 16 Dec 2009 12:59:24 +0000 http://wordpress.org/?v=2.8.6 en hourly 1 Role Based Access Control in ASP.Net MVC http://www.webdevbros.net/2009/12/16/role-based-access-control-in-asp-net-mvc/ http://www.webdevbros.net/2009/12/16/role-based-access-control-in-asp-net-mvc/#comments Wed, 16 Dec 2009 12:59:24 +0000 Dai Bok http://www.webdevbros.net/?p=874 Currently I am looking at access control systems, and how best to integrate them with ASP.Net MVC framework. While this framework already provides support for role based access control (RBAC), using the membership classes. I need to implement this on a legacy database, and some how integrate the old system with asp.net forms authentication. This post is about how I realised this, and acts a potential solution. If you can think of a better way, of find any devastating flaws, let me know. ;-)

The scenario is simple, we have four roles defined for the system. They are Students, Graduates, Staff and Administrators. Some staff can be graduates, (or even Students). Administrators are, of course staff! So how you model this? We already know of one bitwise trick from Michal’s post, so let us see how we can use bitwise operations to make this a reality!

First let us revise the results of the bitwise AND operations. You can check Wikipedia for full details.

1 & 0 = 0
0 & 1 = 0
0 & 0 = 0
1 & 1 = 1

Converting these back to decimal 1001 is 9 and 0101 is 5. So 9 & 5 = 8. If we convert each of these bits to represent a role in our system, we can come up with a table like this.

Bit 1 0 (false) Student
Bit 2 0 (false) Graduate
Bit 3 0 (false) Staff
Bit 4 1 (true) Admin

So a user of the system with a role number of 8 is an Admin, but in our case, an Admin is also a member of staff, and in fact, a member of staff could also be a student or a graduate. This is where using bitwise operations can really help model such a situation. To get it working, a staff member who is a student will have bits 1 and 3 set to true, while a graduate who is also a staff member will have bits 2 and 3 set to true. We can represent these roles in decimal as User(Staff & Graduate) = 6, while User (Staff & Student) = 5. Get the picture?

Let’s look at a simple real world example. First we have a User class, with a Role property of the type int. The reason we use an integer, is that is can be easily stored in the database.

    1     public class User {

    2 

    3         public string Name { get; set; }

    4         public int Role { get; set; }

    5         public bool IsInRole(Role role) {

    6             //todo

    7             return false;

    8         }

    9     }

We also need to create an enumeration, with a Flags attribute. The flags attribute tells the compiler that this enumeration can be treated as a bit field. We then define a value for each role. The reason for using exponents of 2 should become clearer later.

    1     [Flags]

    2     public enum Role {

    3         Student = 1,    // 0001

    4         Employer = 2,   // 0010

    5         Staff = 4,      // 0100

    6         Admin = 8       // 1000

    7     }

The menu of our website needs to be generated depending on the user role. The menu selection code below should generate the correct menu depending on the user role.

    1     <div class="LeftMenu"> 

    2 

    3         <% if (user.IsInRole(Role.Student)) %>

    4             <% Html.RenderPartial("StudentMenu"); %>

    5 

    6         <% if (user.IsInRole(Role.Graduate)) %>

    7             <% Html.RenderPartial("GraduateMenu"); %>

    8 

    9         <% if (user.IsInRole(Role.Staff)) %>

   10             <% Html.RenderPartial("StaffMenu"); %>

   11 

   12         <% if (user.IsInRole(Role.Admin)) %>

   13             <% Html.RenderPartial("AdminMenu"); %>

   14 

   15     </div>

Ok, so let see where the magic happens! If we AND (&) the user assigned role, with the role required, and we compare this result to the role required, we can determine if a user is in the role. Summarised, the end result of the AND operation needs to equal that of the role required. In user class we have the method:

    1         public bool IsInRole(Role role) {

    2             Role userRole = (Role)this.Role;

    3             return ((userRole & role) == role);

    4         }

Looking at some binary examples, we can see how it works. In the first example, an admin user wants accesses a graduate item.

Role Required Staff(4) 0 1 0 0
User Role Admin (8) 1 0 0 0
Result of & Access Denied (0) 0 0 0 0


It is clear that we have a problem here, because we said that admin could be both staff, and staff may also be graduates. What we need to do is add up the roles, so that this user will access both admin and staff content. Assigning the user the role of Admin and Staff is easy. All we do is:

    1             User user = new User();

    2             user.Role = (int)Role.Staff;

    3             user.Role += (int) Role.Admin;

And the resulting table is:

Role Required Staff(4) 0 1 0 0
User Role Admin + Staff (12) 1 1 0 0
Result of & Access Granted (4) 0 1 0 0

Now we can easily draw our menu depending on the roles assigned to a user. Adding or removing roles for a user is also easy, just add it or subtract it. I wrote a little project to go with this so you can test it our your self. Thanks to Michi for introducing this, and Dan for helping work it out!

Download the Roles sample project You’ll need to use nUnit to test it.

]]> http://www.webdevbros.net/2009/12/16/role-based-access-control-in-asp-net-mvc/feed/ 0 picnik comes with a free-to-use image editing API for your website http://www.webdevbros.net/2008/01/23/picnik-comes-with-a-free-to-use-image-editing-api-for-your-website/ http://www.webdevbros.net/2008/01/23/picnik-comes-with-a-free-to-use-image-editing-api-for-your-website/#comments Wed, 23 Jan 2008 03:32:11 +0000 Michal http://www.webdevbros.net/2008/01/23/picnik-comes-with-a-free-to-use-image-editing-api-for-your-website/ picnic.gif Ever heard from Picnik? It allows you editing your images direclty within your browser. Forget Adobe Photoshop :) Picnik has been around for a while now but recently it started to offer its service for the public. for free! I played around a bit and must say that it is amazing .. Use it within PHP, classic ASP, .net, Ruby on Rails or whatever... especially i like the idea of the whole service which works like this...

  1. Send your images to their service (existing image via URL or encoded as multi-part)
  2. Then the user modifies the picture (size, colors, rotation, special effects...)
  3. Picnik sends you the picture back to your server (either an URL where you can download it or directly as multi-part image)

Here comes an example I have built for demonstration...Click on the picture below to edit it.

googleapple.jpg

Everything realized by using a link to this URL:

PLAIN TEXT
HTML:
  1. http://www.picnik.com/service/
  2.   ?_apikey=178ef7667a0c301dd8eb89e76caba626
  3.   &_import=http%3A//www.webdevbros.net/wp-content/uploads/2008/01/googleapple.jpg
  4.   &_export=http%3A//www.webdevbros.net/2008/01/23/picnik-comes-with-a-free-to-use-image-editing-api-for-your-website
  5.   &_export_title=back%20to%20webdevbros

Pretty cool isn't it? Thats the basic example but you can customize a lot more (see their API). Also I didn't progress the picture back on my server.

If you want to get started i recommend to start with their tutorials. They are nicely written and done in 10 minutes.

]]> http://www.webdevbros.net/2008/01/23/picnik-comes-with-a-free-to-use-image-editing-api-for-your-website/feed/ 1 C# tips, tricks and things you should know http://www.webdevbros.net/2007/11/14/c-tips-tricks-and-things-you-should-know/ http://www.webdevbros.net/2007/11/14/c-tips-tricks-and-things-you-should-know/#comments Wed, 14 Nov 2007 11:33:25 +0000 Michal http://www.webdevbros.net/2007/11/14/c-tips-tricks-and-things-you-should-know/ .net components During my previous holidays (i have to admit 1.5 months surfing in portugal) I had some literature with me which also included the book Programming .net components released with O'Reilly. It talks about the aspects of components in general and provides good examples how to achieve those in .net. Although these pages are a very good read (rather for experienced devs) for ppl interested in component development, I found it more interesting because of its general C# content. There are concepts & approaches, small tips & tricks and intersting things about C# which can be used not only in component based architectures and are therefore good to know anyway.

As I always make notes while reading "geek" books I thought: "so why not summarize them all up in a nice list and blog'em". Here we go...

1. implicit vs explicit interface
implicit interface implementation allows to use the interface member through an object or through the interface whereas the explicit interface implementation allows only access through the interface.

PLAIN TEXT
C#:
  1. //public interface IInterface {
  2.    void Foo();
  3. }
  4. //implicit implementation
  5. public AClass : IInterface {
  6.    public void Foo() { }
  7. }
  8. //explicit implementation
  9. public BClass : IInterface {
  10.    void IInterface.Foo() { }
  11. }
  12. //usage implicit
  13. AClass a = new AClass();
  14. a.Foo();
  15. IInterface b = new AClass();
  16. b.Foo();
  17. //usage explicit
  18. IInterface c = new BClass();
  19. c.Foo();
  20. BClass d = new BClass();
  21. d.Foo() //Fails because of explicit implementation!!!

Visual studio just offers the choice of the implementation but most people don't know the difference. With explicit implementation the server (implementing the interface) can prevent clients from using it directly on object which implements it. It forces that the members of the interfaces are only accessible via the interface itself

2. implicit vs explicit cast
this is just to get used to the terminology because a lot of guys are using it but don't know the terminology ;)

PLAIN TEXT
C#:
  1. //implicit cast
  2. T x = new T
  3. //explicit cast
  4. T x = (T)y
  5. //explicit cast (defensive)
  6. T x = y as T

Here you see that implicit casting is assigning a class instance directly to a variable. Explicit means casting from one type to another.

3. Destructors
A destructor of a class is defined with ~ClassName. In comparison to Dispose() the C# destructor is always called. Dispose() needs to be called by the client whereas the destructor is called when the garbage collector comes around. Best way is to implement both and channel the implementation to the method which does the cleanup. e.g. cleanup. Example of implementation [COMP05, 98]:

PLAIN TEXT
C#:
  1. public class MyBase : IDisposable {
  2.    private bool _disposed = false;
  3.    protected bool Disposed {
  4.       get {
  5.          lock(this) {
  6.             return _disposed;
  7.          }
  8.       }
  9.    }
  10.    public void Dispose() {
  11.       lock(this) {
  12.          if (!_disposed) {
  13.             CleanUp();
  14.             _disposed = true;
  15.             GC.SuppressFinalize(this);
  16.          }
  17.       }
  18.    }
  19.    //the method for the subclasses if they need to release resources
  20.    protected virtual void CleanUp() { }
  21.    ~MyBase{
  22.       CleanUp();
  23.    }
  24. }

Classes deriving from this baseclass can now implement their destruction by overriding the cleanup method and can now decide to do the clean up manually (calling Dispose) or leave it till the GC comes around. Important here is that if Dispose() was called we tell the garbage collector to exclude this instance from being garbaged later (with GC.SuppressFinalize()).

4. use "Using" defensive

PLAIN TEXT
C#:
  1. using (obj as IDisposable) {
  2. }

This approach will only call Dispose() if the object implements IDisposeable. Good if you dont really know if the object needs to release resources or not and if you want to be ready for future changes. e.g. the server decides to implement IDisposeable.

5. Delegate inference

PLAIN TEXT
C#:
  1. //instead
  2. publisher.someDelegate += new Delegate(someMethod)
  3. //u can use
  4. publisher.someDelegate += someMethod

This is much nicer to read but only supported with .net 2.0.

6. Custom event arguments
Custom event arguments (own class derrived from EventArgs) should have only readonly members. This prevents the client from changing the values. Readonly members can only be assigned in the constructor so the publisher of the event is able to set the values when creating the arguments.

7. Always fire events in a try catch block
You never know what the event handler method of the client does, so its good to put the firing into a try catch block. You could write your own EventsHelper class [COMP05, 144] for the purpose of firing event within your classes.

PLAIN TEXT
C#:
  1. public static class EventsHelper {
  2.    public static void Fire(Delegate d, params object[] args) {
  3.       if (d == null) return;
  4.       Delegate[] dels = d.GetInvocationList();
  5.       foreach(Delegate sind in dels) {
  6.          try {
  7.             sink.DynamicInvoke(args);
  8.          } catch {}
  9.       }
  10.    }
  11. }

8. use "property-like" approach for event accessors
As you do with common member variables (expressing them with properties) you also should do this with events. This alows you to control the adding and removing of event handlers for your event.

PLAIN TEXT
C#:
  1. public class MyClass {
  2.    MyHandler _myEvent;
  3.    public event MyHandler MyEvent {
  4.       add {
  5.          _myEvent += value;
  6.       }
  7.       remove {
  8.          _myEvent -= value;
  9.       }
  10.    }
  11. }

9. Static objects as keys

PLAIN TEXT
C#:
  1. static name = new Object();
  2. myCollection[name] = "a name"
  3. //instead of (old school)
  4. myCollection["name"] = "a name"

a static object is created to act as a key for e.g. collections (because every instance is unique - has its own identity!). The advantage in comparison to the "old school" version (key is a string) is that the key is already available in memory wheras the string needs to be created everytime. If you use this key in a lot of places it could save some time.

10. Combine enumeration values

PLAIN TEXT
C#:
  1. public enum color {
  2.    red,
  3.    green,
  4.    all = red | green
  5. }

This example illustrates that it is possible to have enumeration values which accept more than one existing values of the current enumeration.

11. Singelton Application
A singelton application is one which only allows running one instance per machine. e.g. Microsoft Outlook is a singelton application. Everytime the user starts the application it will check if an instance is already running. If its not running it will launch it otherwise it will focus to the current one. The source for an application which runs only once is available in another post "Singelton Application with C#"

12. Containment
If it is not possible to derive from a class we use a class to wrap around the class we would like to inherit from. This procedure is also known as "Containment" (I mention it here because the this term is more unknown - usually developers use wrapper)

13. Use Debug.Assert()
The use of Debug.Assert should be used as often as possible. During the development the developer should "assert" things which always should be true. This helps finding bugs easier and its easier for other developers to understand the code.

PLAIN TEXT
C#:
  1. int a = 10
  2. int b = 20
  3. int c = 20 - 10
  4. Debug.Assert(c> 0, "i need it bigger than 0. check might be done in the future")
  5. Console.WriteLine(10 / c)

This short example demonstrates that obviously the developer expects the variable "c" to be greater than 0. Why? Because in the next line he/she uses it for a dvision which would break with c = 0. If this is the case you would get an information seen in line 4. This concept is nice because it makes comments "active".

14. user string instead of String
String is just an alias for string and therefore its nicer to use the original type straight away. The same with int and Int32, etc.

15. Rethrowing exceptions

PLAIN TEXT
C#:
  1. try {
  2. } catch(Exception e) {
  3.    //some logging,etc...
  4.    throw;
  5. }

This piece of code rethrows the exception. The interesting thing here is that you dont need to specify the Exception explicitly. Just the keyword "throw" is enough to rethrow the exception.

15. Code exclusion with attributes and not with #if .. #endif

PLAIN TEXT
C#:
  1. [Conditional("DEBUG")]
  2. void Foo() {
  3. }

The advantage here is that the code is not reachable anymore if the condition is not met. This means that it will result in compile errors if you reference this method. #if ... #endif does not enforce this constraint. Its also nicer than the hash signs ;) Please check the MSDN Reference for more details about the conditional attribute.

Thats was it :) Hope there was something interesting and maybe new for everyone. I dont want to promote the book here but I really recommend it because it contains good content about programming with c# (and especially for component development) and should be read by every C# developer who wants to develop for enterprise.

Maybe you have some interesting tips & tricks which might be useful for others. Please be so nice and comment them... I am interested.

Resources:
[COMP05] .net Components, Juval Löwy, O'Reilly 2005 United States

]]> http://www.webdevbros.net/2007/11/14/c-tips-tricks-and-things-you-should-know/feed/ 6 8 Reasons to Stick with ASP 3.0 in 2006 (and 2007) http://www.webdevbros.net/2007/03/30/8-reasons-to-stick-with-asp-30-in-2006-and-2007/ http://www.webdevbros.net/2007/03/30/8-reasons-to-stick-with-asp-30-in-2006-and-2007/#comments Fri, 30 Mar 2007 08:56:55 +0000 Michal http://fabiankoehler.de/wdb/?p=27 Today I was browsing through the microsoft.­public.­inetserver.­asp.­general newsgroup and found a nice article linked within a topic where people are talking about classic ASP and its brother .net. The article outlines 8 reasons to stick with the good old classic ASP ... Unfortunately I cannot really figure out when the article was written but i think it must be quite recent because they bring up VS2005 and web 2.0.

As I have done already some projects with .net I love this statement (refers to web-projects):

Sluggish is a word to describe the whole of the .NET development environment. Starting a new project? Go make a cup of coffee. Switching between tabs? 'Go large' with your coffee. Pressing F1 for help? Make your coffee a take-out and go and have a stroll in the park.

http://www.packtpub.com/article/Classic-ASP

]]> http://www.webdevbros.net/2007/03/30/8-reasons-to-stick-with-asp-30-in-2006-and-2007/feed/ 11