I often have to build small “one-off” apps to do updates to the database for my company’s mortgage software. Due to the way the software was built by our vendor direct SQL updates to change a value in a loan application are not allowed as you have to update several tables in order to trick the many constraints to “think” the software is running in memory with the loan in question open. This reason for this type of security is that when you update specific field in the system there can be several other scripts firing to update other data points within the loan (recalculation interest, changing documents, and other validation type checks).
To get around this problem I have created a VB.Net Web script that is embedded into a web service that will open the loan in memory and update a specified field then close the loan to commit the changes. (More about this service in a different post.)
Often these one-off applications I make are only used by the internal support group and never by end-users. To make things a bit easier for our support people I have made a simple authentication checker that takes the windows user ID the system is logged in as and runs it through a list of valid users that are listed in a XML document and allows access to these little tools I build. If you are not on the list it will return false and won’t let you in.
This methos should go into the Session Start method of global.asax of your web application.
Here is a sample of the XML Document:
<?xml version=”1.0″ encoding=”utf-8″ ?>
<!–This is a list of users authorized to preform actions is this webpage.–>
<userlist>
<user name=”Jason Developer” id=”JD8564″/>
<user name=”Joe Tester” id=”JT9877″/>
<user name=”Jane BA” id=”JB0251″/>
</userlist>
Here is the method I built*:
protected void Session_OnStart()
{
Session["isValid"] = false; //Assume they are not authorized
IIdentity WinId = HttpContext.Current.User.Identity; //Read the window's ID of the person logged into the machine connecting to the site
string userid = WinId.Name.Substring(WinId.Name.ToString().IndexOf('\\') + 1);
Session["LoggedInUser"] = userid; //just for testing to see what is being captured
Hashtable userTable = new Hashtable();//Hash Table to store a User list (ID and Names)
XmlDocument xmlDoc = new XmlDocument();
xmlDoc.Load(Request.ServerVariables["APPL_PHYSICAL_PATH"].ToString() + "UserList.xml");//Load the XML Doc that is a list of "Allowed users"
XmlNodeList xmlNode = xmlDoc.GetElementsByTagName("user");
//Put the XML List into the HasTable
for (int i = 0; i < xmlNode.Count; i++)
{
XmlAttributeCollection xmlattrc = xmlNode[i].Attributes;
userTable.Add(xmlattrc[0].Value.ToString(), xmlattrc[1].Value.ToString());
}
//Verify the person logged in is allowed to access site
//Loop through the hashtable, get names and id of user and set them into session for use
foreach (DictionaryEntry ent in userTable)
{
string Key = ent.Key as string;
if (ent.Value.ToString().Equals(userid))
{
Session["isValid"] = true;
Session["UserName"] = Key.ToString();
Session["UserID"] = ent.Value.ToString();
break;
}
}
}
* Note: You will need the following references:
using System.Security.Principal;
using System.Xml;
using System.Collections;
*Update: Fixed code to actually work when deployed on a server.