Authentication and Authorization Using IPrincipal Interface

Authentication is the process of the system identifying an individual based on the information provided by him. That is generally the user id and word. Authentication is essential for effective security. Authentication is different from authorization. Whereas the former means only identifying the user, the latter means denying or granting some access to someone.

IPrincipal defines the basic functionality of a principal object. The security context of the user for whom the code is running is represented by the IPrincipal object, along with that user's identity (IIdentity) and any roles to which they belong.

In this example we will use the IPrinicipal interface instead of IIdentity and then override PostAuthenticateRequest in global.asax.cs for reading the value from a cookie.

1. Creating the interface

In the following sample the interface MyIPrincipal is inherited from the IPrincipal inheritance.

interface MyIPrincipal: IPrincipal
{
   string Id { get; set; }
   string UserName { get; set; }
}

Next we shall create a custom interface.

2. Creating a custom interface

We will be inheriting this custom interface from the interface we just inherited from the IPrincipal interface. In the following sample we have created a custom interface MyCustomPrincipal and added all the custom information we need.

public class MyCustomPrincipal : MyIPrincipal
{
   public IIdentity Identity { get; private set; }
   public bool IsInRole(string role) { return false; }
   public MyCustomPrincipal(string email)
   {
      this.Identity = new GenericIdentity(email);
   }
   public string Id { get; set; }
   public string UserName { get; set; }
   public int IsAdmin { get; set; }
}

Next, we need to create a class that will serialize all the properties and custom information of MyCustomPrincipal into the userdata field of the FormsAuthenticationTicket object.

3. Creating a serialize model

In the following sample we create a serializer for serializing the object of type MyCustomPrincipal into the userdata field of the FormsAuthenticationTicket object. 

public class CustomPrincipalSerializer
{
   public string Id { get; set; }
   public string UserName { get; set; }
   public int IsAdmin { get; set; }
}

Now we need to create a cookie to save all the custom information. So, for this we create a method in the login page.

4. Saving information in the cookie

In the following code we create a method, SaveSession. In this method we serialize the user details and save that in the FormsAuthenticationTicket object's userData field. 

CustomPrincipalSerializer objSerializer = new CustomPrincipalSerializer();
objSerializer.Id = user.UserHashCode;
objSerializer.UserName = user.UserName;
objSerializer.IsAdmin = Convert.ToInt16(user.IsAdmin);
JavaScriptSerializer serializer = new JavaScriptSerializer();
string userData = serializer.Serialize(objSerializer);
FormsAuthenticationTicket formAuthTicket = null;
formAuthTicket = new FormsAuthenticationTicket(1,user.EmailId,DateTime.Now,DateTime.Now.AddMinutes(15),false,userData);
string encformAuthTicket = FormsAuthentication.Encrypt(formAuthTicket);
HttpCookie formAuthCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encformAuthTicket);
System.Web.HttpContext.Current.Response.Cookies.Add(formAuthCookie);

The FormsAuthenticationTicket object is then encrypted and saved in the HttpContext’s cookies.

After the cookie is added we call another method SaveSessionData to save the encrypted cookie value in the database.

5.Reading information from the cookie

We ought to override a PostAuthenticateRequest method in the global.asax.cs. Here we read the cookie and replace HttpContext’s user object with it. 

HttpCookie formAuthCookie = Request.Cookies[FormsAuthentication.FormsCookieName];
if (formAuthCookie != null)
{
   //Decrypt the cookie value.
   FormsAuthenticationTicket formAuthTicket = FormsAuthentication.Decrypt(formAuthCookie.Value);
   JavaScriptSerializer objSerializer = new JavaScriptSerializer();
   //Deserialize the cookie value
   CustomPrincipalSerializer serializeModel = objSerializer.Deserialize<CustomPrincipalSerializer>(formAuthTicket.UserData);
   MyCustomPrincipal newUser = new MyCustomPrincipal(formAuthTicket.Name);
   newUser.Id = serializeModel.Id;
   newUser.UserName = serializeModel.UserName;
   newUser.IsAdmin = serializeModel.IsAdmin;
   //Save details in the httpcontext
   HttpContext.Current.User = newUser;
}

6.Accessing the information

In the PostAuthenticateRequest method the cookie value is read, decrypted, de-serialized and saved in HttpContext’s user instance for further access.

In this example I have used webform, so in the master page we can read the value of the current user from HttpContext and use it throughout the application.

public MyCustomPrincipal CurrentUser
{
   get
   {
    if (HttpContext.Current.User != null)
    {
       return HttpContext.Current.User as MyCustomPrincipal;
    }
    else
    {
       return null;
    }
   }
}

Now we can use a HttpContext.User object, CurrentUser to access the values saved in the cookie. In the following example we first check whether the user exists or not, if the user exists we just access the value we require. It is as simple as that.

The following screen shot shows all the cookies set by the page before log in. 

And, here we can see all the cookies set by the page after login. The method used in this example for saving data in the cookie is secured, because the value saved in the cookie is encrypted. 

To remove the cookie from the browser, we need to use the FormAuthentication’s SignOut method. 

The SignOut method, as used in the preceding, removes the form authentication ticket from the browser.

Thank you for reading. I hope it helps you all.