Firstly, I’ve implemented custom principal inherited from GenericPrincipal class, custom permission that implements IPermission and IUnrestrictedPermission. And than as it is expected I implement my realization of CodeAccessSecurityAttribute in order to be able to have declarative security. It contains a property for setting/getting the resource type. I also pass all the path to sign my assembly and put it into GAC etc. And then I’ve tried to see how it works and Bum! I got the exception "COMException- Unsupported type for field or property setter" which told me that what is wrong with my security attribute properties. I supposed that the reason is my resource type property and I was right. Here is a bug report about this problem. Actually, it is not a bug but a normal situation when it is a design problem :(.

It is clear that I can use type with an implementation of a custom security attribute based on CodeAccessSecurityAttribute. But what do you think about using an aspect? I chose to use an aspect attribute in order to achieve a declarative security. I used PostSharp to create my aspect attribute.

   1: [Serializable]

   2: [AttributeUsage(AttributeTargets.Event | AttributeTargets.Field | AttributeTargets.Method | AttributeTargets.Constructor | AttributeTargets.Struct | AttributeTargets.Class | AttributeTargets.Assembly, AllowMultiple = true, Inherited = true)]

   3: public class PermissionAspectAttribute : OnMethodBoundaryAspect

   4: {

   5:     public Type ResourceType { get; private set; }

   6:     public Permission NeededPermission { get; private set; }

   7:  

   8:     public PermissionAspectAttribute(Type resourceType, Permission neededPermission)

   9:     {

  10:         ResourceType = resourceType;

  11:         NeededPermission = neededPermission;

  12:     }

  13:  

  14:     public override void OnEntry(MethodExecutionEventArgs eventArgs)

  15:     {

  16:         ResourcePermission permission = new ResourcePermission(ResourceType, NeededPermission);

  17:         permission.Demand();

  18:     }

  19: }

You can see that I instantiate my permission and call its Demand() method. Then it was easy to use the attribute in a code. Let’s assume that I have a method Get() as in the snippet below.

   1: [PermissionAspect(typeof(User), Permission.View)]

   2: public ICollection<User> Get()

   3: {

   4:     ICollection<User> users = DummyMethod();

   5:     return users;

   6: }

PostSharp includes the aspect code into the method decorated during the compilation of the program. This way I have a way to use my custom security declaratively and all people of the team do not need to right each time permission initialization code.

   1: FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, FormsAuthentication.FormsCookieName,

   2:     DateTime.Now, expiredTime, persist, null, FormsAuthentication.FormsCookiePath);

   3:  

   4: HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(ticket));

Firstly, I wasn’t able to continue to default page of the site and I was always returned to the login page. After checking that all of my code is ok I observed created cookie and what I’ve seen was that it doesn’t contain any data. Normally, it should contain encrypted ticket. Then I saw that the call of FormsAuthentication.Encrypt(ticket) returns null.

After replacing null with string.Empty in the constructor of FormsAuthenticationTicket all went fine.

   1: FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, FormsAuthentication.FormsCookieName,

   2:     DateTime.Now, expiredTime, persist, string.Empty, FormsAuthentication.FormsCookiePath);

I do not know what is the reason of such behavior but for me it is unnatural behavior.

Let’s say that there is a web site that is configured to use Windows authentication in ISS and in the web configuration file we have Windows authentication with no impersonation. In addition, there is a web service that is configured in the same way. In such configuration HttpContext.User and Thread.CurrentPrincipal contain domain\user_name and WindowsIdentity is machine\aspnet. in such case when the web application tries to access the web service machine\aspnet user is used and such user doesn’t have rights to access the web service.

How to solve this?

The easiest way I have in mind is to impersonate the user from HttpContext.User. It is shown in the snippet below. This way the web service is called with right credentials.

   1: CustomWebService.ServiceName service = new CustomWebService.ServiceName();

   2: sws.Url = "<url>";

   3: sws.UseDefaultCredentials = true;

   4: CustomWebService.RetrievedData data; 

   5: using (WindowsImpersonationContext context = WindowsIdentity.Impersonate((HttpContext.Current.User.Identity as WindowsIdentity).Token))

   6: {

   7:     data = service.GetSomeData();

   8: }

   9:  

  10: // use data retrieved from the service

Note that I use using statement in order to guarantee that after the scope I need impersonation it will be undone. i do not call directly Undo() method of WindowsImpersonationContext but it is called internally by Dispose() method.

Today, I’ve tried to achieve the same functionality but using AOP. Actually, I’ll use PostSharp platform in order to weave needed code in each test method decoreted with RollBackAttribute. PostSharp does it at compile time and do nothing in the run-time. Many people like to have an option to change the aspect during run-time but in my case I do not need it and PostSharp is ideal for doing what I need.

Let me start with RollBackAttribute class. It inherited from OnMethodBoundaryAspect and override OnEntry and OnExit methods. It begins a new transaction per each call and it rollbacks it after execution.

[Serializable]
public class RollBackAttribute : OnMethodBoundaryAspect
{
	ITransaction transation = null;

	public override void OnEntry(MethodExecutionEventArgs eventArgs)
	{
		transation = SessionManager.CurrentSession.BeginTransaction();
	}

	public override void OnExit(MethodExecutionEventArgs eventArgs)
	{
		if (transation != null)
		{
			transation.Rollback();
			transation.Dispose();
		}
	}
}

Now we are ready to decorate any test method with RollBack attribute.

[Test]
[RollBack]
public void AddNewModule()
{
	Module module = CreateModule();

	ModuleRepository repository = new ModuleRepository(SessionManager.CurrentSession);
	repository.Add(module);

	Module result = RetrieveModelFromatabase(module, SessionManager.CurrentSession);

	Assert.IsNotNull(result);
}

But how it will look after compilation? Below is a screen shot from .Net Reflector.

In red is the code we have in AddNewModule test method and in light blue is the execution of OnEntry and OnExit methods of OnMethodBoundaryAspect. As you can see the code we needed is weaved into the method during compile time and will be executed.

Here I’d like to present you the standard ASP.Net MVC application which is generated when you create an ASP.Net MVC application using Visual Studio. I’ve just reorganized it a bit in order to add into it Composite Web Application Block (CWAB). Let me say that this block is the core of the WCSF and it is created in order to cover its needs but using it as an infrastructure I think we are able to create an ASP.Net MVC application composite.

You can download the source code from here.

The first what I’ve did was to create a new MVC application and to add Microsoft.Practices.CompositeWeb.dll, Microsoft.Practices.CompositeWeb.EnterpriseLibrary.dll, Microsoft.Practices.ObjectBuilder.dll into its root folder (in a separate directory :)). I add three additional libraries into my solution Utils, Shell and HelpModule. It is depicted at the picture below.

The Utils library is not used as a business or foundational module but it contains class used in my application to register my own information about modules. ModuleMenuInfo class is an info class which contains module information that I use in web application.

public class ModuleMenuInfo
{
	public string Key { get; set; }
	public string Title { get; set; }
	public string Controller { get; set; }
	public string Action { get; set; }
}

The second class is ModuleMenuManager which manages module information. It allows adding, removing a module and retrieving all available modules.

public class ModuleMenuManager : IModuleMenuManager
{
	private IDictionary<string, ModuleMenuInfo> _modules;

	public ModuleMenuManager()
	{
		_modules = new Dictionary<string, ModuleMenuInfo>();
	}

	#region IModuleManager Members

	public void AddModule(ModuleMenuInfo moduleInfo)
	{
		// code ...
	}

	public void RemoveModule(ModuleMenuInfo moduleInfo)
	{
		code ...
	}

	public IEnumerable<ModuleMenuInfo> GetModules()
	{
		return _modules.Values;
	}

	#endregion
}

Then I’ve created a module named Shell which is a required module for the application at whole. All additional modules depend on it. Normally, it should contain registration of any global services and other configuration operations. In my case I use it only for registering ModuleMenuManager class as a global service in order to use it in other modules for registering their selves. in addition, It registers itself to ModuleMenuManager because I need to display initial information in the shell. In a standard WCSF application it is a functional module and it doesn’t have any connection with the web site. In my case it is the same but it just adds some information used by presentation layer.

public class ShellModuleInitializer : ModuleInitializer
{
	private IModuleMenuManager _moduleMenuManager;

	public override void Load(CompositionContainer container)
	{
		base.Load(container);

		AddGlobalServices(container.Parent.Services);
		RegisterSiteMapInformation();
	}

	protected virtual void AddGlobalServices(IServiceCollection serviceCollection)
	{
		_moduleMenuManager = new ModuleMenuManager();
		serviceCollection.Add<IModuleMenuManager>(_moduleMenuManager);
	}

	protected virtual void RegisterSiteMapInformation()
	{
		_moduleMenuManager.AddModule(new ModuleMenuInfo()
		{
			Key = "Shell",
			Title = "Home",
			Controller = "Shell",
			Action = "Index"
		});
	}
}

As you can see ShellModuleInitializer inherits from ModuleInitializer class. It is a class from CWAB and each module should implement a class which inherits from him in order to register its services, types or whatever it needs to do at the time of module initialization.

The second module that I’ve created is a business module named HelpModule. It doesn’t contain any special functionality but a simple class named HelpLogic which only returns a method that returns a title name.

public class HelpLogic
{
	public string GetTitle()
	{
		return "About Page";
	}
}

It also has its own HelpModuleInitializer class where it retrieves an instance of IModuleMenuManager and use it in order to register its self.

public override void Load(CompositionContainer container)
{
	base.Load(container);
	RegisterSiteMapInformation(container.Parent.Services.Get<IModuleMenuManager>(true));
}

Finally, modules of my composite MVC application are ready for use and I can change the standard MVC application in the way that it will behave as a composite application. First of all I went to global.asax.cs file and change it as it is shown below.

public class MvcApplication : WebClientApplication
{
	public static void RegisterRoutes(RouteCollection routes)
	{
	routes.IgnoreRoute("{resource}.axd/{*pathInfo}");

	routes.MapRoute(
		"Default",                                              // Route name
		"{controller}/{action}/{id}",                           // URL with parameters
		new { controller = "Shell", action = "Index", id = "" }  // Parameter defaults
	);

	}

	protected override void Start()
	{
		base.Start();
		RegisterRoutes(RouteTable.Routes);
		ControllerBuilder.Current.SetControllerFactory(new CompositionControlerFactory());
		base.AddRequiredServices();
	}
}

I’ve change it to inherit from WebClientApplication file which is a class from CWAB which inherits from HttpApplication and extends it. Further, I delete Application_Start method and override Start method of WebClientApplication. It is executed only once when the application is started. There I registered the routes and I set my custom controller factory. AddRequiredServices of WebClientApplication registers all missed services used of CWAB.

CompositionControlerFactory class I need for executing WebClientApplication.BuildItemWithCurrentContext in order to build up the controller class requested and it will use ObjectBuilder to inject all dependencies a controller needs.

public class CompositionControlerFactory : DefaultControllerFactory
{
	protected override IController GetControllerInstance(Type controllerType)
	{
		if (controllerType != null)
		{
			object controller = Activator.CreateInstance(controllerType);
			WebClientApplication.BuildItemWithCurrentContext(controller);
			return controller as IController;
		}
		return null;
	}
}

Further, I needed a BaseController class for getting all registered modules information and put it into ViewData. You can note that it has a property which holds an instance of IModuleMenuManager and that this property is decorated with ServiceDependency attribute from CWAB. Re-writing GetControllerInstance of DefaultControllerFactory I call WebClientApplication.BuildItemWithCurrentContext which will build up and inject needed class. But here I use ServiceDependency which tells CWAB that I need a service. Here I’ll get into ModuleMenuManager property a singleton of target class because I registered it as a global service and because I use ServiceDependency attribute. If I needed an unique instance for my controller I would use CreateNew attribute instead of ServiceDependency attribute.

[HandleError]
public class BaseController : Controller
{
	[ServiceDependency]
	public IModuleMenuManager ModuleMenuManager { get; set; }

	protected void PresetMenuInfo()
	{
		foreach (var item in ModuleMenuManager.GetModules())
		{
			ViewData[item.Key + "_module"] = item;
		}
	}
}

I also created a HelpController class which is connected with HelpModule business module. Note that here I use CreateNew attribute in order to tell CWAB to build up for me a new instance of HelpLogic class each time I create HelpController.

public class HelpController : BaseController
{
	[CreateNew]
	public HelpLogic HelpLogic { get; set; }

	public ActionResult About()
	{
		base.PresetMenuInfo();

		ViewData["Title"] = HelpLogic.GetTitle();

		return View();
	}
}

Finally, I changed a bit the master page of the application in order to analyze the information from ViewData and according to it to add and remove menus.

<ul id="menu">
<%
if (ViewData["Shell_module"] != null)
{
	Utils.ModuleMenuInfo shellModule = (ViewData["Shell_module"] as Utils.ModuleMenuInfo);
%>
<li><%= Html.ActionLink(shellModule.Title, shellModule.Action, shellModule.Controller)%></li>
<%
}
if (ViewData["Help_module"] != null)
{
	Utils.ModuleMenuInfo helpModule = (ViewData["Help_module"] as Utils.ModuleMenuInfo);
%>
<li><%= Html.ActionLink(helpModule.Title, helpModule.Action, helpModule.Controller)%></li>
<%
}
%>
</ul>

Oh, I almost forgot to share that I also change Web.config file of the application where I’ve added information that CWAB uses to register my Shel foundational module.

<compositeWeb>
	<modules>
		<module name="Shell" assemblyName="Shell" virtualPath="~/"/>
	</modules>
</compositeWeb>

I’ve also changed the Web.config file which is placed into Views folder. There I’ve added information about HelpModule business module. Note that it has a tag dependencies where one can list all modules the current depends on.

<compositeWeb>
	<modules>
		<module name="HelpModule" assemblyName="HelpModule" virtualPath="~/Views/Help">
			<dependencies>
				<dependency module="Shell" />
			</dependencies>
		</module>
	</modules>
</compositeWeb>

I hope that you note virtualPath attribute in both XML snippets. It is not used in any case in this realization but it is used by CWAB and without it it will not work properly.

And now let me show two screens one when HelpModule module is registered via Web.config and one when it doesn’t registered. Below is the first snapshot where you can see two menus home and about.

And here is the second snapshot with only one menu attached because HelpModule module is not registered in the configuration file.