I'm running VWD as administrator on Vista.

I have a login form authenticating users with table-based security. When the login form post back with the user name and password the code executes using the correct custom principal object.

The default page displays. When I click a link to load a page that calls a database to load a datagrid, the code is now using a System.Security.Principal.GenericPrincipal which throws a security exception, because the code requires the custom principal object that the login page was using?

Description: The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.

Exception Details: System.Security.SecurityException: Principal must be of type BusinessPrincipal, not System.Security.Principal.GenericPrincipal

BusinessPrincipal is my custom principal object.

Any idea why the other page is using a System.Security.Principal.GenericPrincipal?

When I run this app using a Windows interface, everything run right. When I run it as a Web app, not working so good.

I'm a security novice, so I'm not even really sure where to start looking.

Bob

Hi Bob,

Take a look here: http://forums.lhotka.net/forums/thread/2420.aspx

Additionally, you need some code in Login.aspx and in Global.asax to make this work correctly. The setup chapters show you what to configure where and how, while the ProjectTracker application shows you what code you need to make this work in a web application.

HtH,

Imar
---------------------------------------
Imar Spaanjaars
http://Imar.Spaanjaars.Com
Everyone is unique, except for me.
Author of ASP.NET 2.0 Instant Results and Beginning Dreamweaver MX / MX 2004
Want to be my colleague? Then check out this post.

Hi Imar,

Thanks for the response. I've been struggling with the Global.aspx issue for several days now. Since I'm porting 1.1 code to VWD, I of course bumped into the problem of 1.1 Global.aspx pages having a 2-file implementation and Global.aspx 2.0 having a default single file implmentation. I have found a way to attach a code file to a 2.0 Golbal.aspx page so I could emulate the CSLA 1.1 Global.aspx in Project Tracker. The technique is at:

http://www.xerratus.com/2006/10/20/N...arateFile.aspx

Running the code with this scheme, however, I have a new exception:

Session state is not available in this context.

The code breaks in the Global.aspx file in the Application_AcquireRequestState event handler. I see there is a Mono bug report for this issue at:

http://lists.ximian.com/pipermail/mo...ch/040599.html

Just wondering if this is anything you've bumped into in MS .NET. I've posted to the CSLA forums (don't know why I didn't think of that in the first place) regarding my Project Tracker issues, but if you have any idea why Session information wouldn't be available in the AcquireRequestState event I'd love to hear it.

Thanks as always, and happy holidays.

Bob

Hi Imar,

I corrected the security principal problem. I'm going to start a new thread on ASP.NET 2.0 forum about the session issue.

Principal object problem fixed with the following in Global.asax:

protected void Application_AcquireRequestState(Object sender, EventArgs e)
    {
        // set the security principal to our BusinessPrincipal
        if (Session["CSLA-Principal"] != null)
        {
            Thread.CurrentPrincipal = (IPrincipal)Session["CSLA-Principal"];
            HttpContext.Current.User = Thread.CurrentPrincipal;
        }
        else
        {
            if (Thread.CurrentPrincipal.Identity.IsAuthenticated)
            {
                System.Web.Security.FormsAuthentication.SignOut();
                Server.Transfer("Login.aspx");
            }
        }
    }

Best,

Bob

Sorry for the late replies. I was away for the holidays...

Is everything fixed now?

Imar
---------------------------------------
Imar Spaanjaars
http://Imar.Spaanjaars.Com
Everyone is unique, except for me.
Author of ASP.NET 2.0 Instant Results and Beginning Dreamweaver MX / MX 2004
Want to be my colleague? Then check out this post.