Using the DataPortal before you have an authenticated user

Wbmstrmjb posted on Wednesday, April 08, 2009

How do you use the data portal to authenticate a user before having an authenticated user? We have a 3-tier web app (web, app server, db). The login page needs to authenticate the user, but the authentication is checked in the db. Thus the Principal's Identity's Fetch checks a stored procedure to authenticate. But how can we use the DP before having an authenticated user? It's like a catch-22. Can't auth a user without having an authenticated user to use DP. Any thoughts?

RockfordLhotka replied on Wednesday, April 08, 2009

You can't use the data portal without having a valid user principal. Authenticated or not doesn't matter.

In other words, you need to ensure the app starts out with a valid but probably unauthenticated principal, then you can invoke the data portal to do authentication to get a valid and authenticated principal.

In CSLA 3.6 the requirements on the principal type have been relaxed, so any serializable principal (which includes the default GenericPrincipal) will now work.

RockfordLhotka replied on Wednesday, April 08, 2009

Sorry, should be more clear. Prior to verison 3.6, a "valid" principal is one that inherits from BusinessPrincipalBase.

If you search the forum you'll find numerous threads about this, and if you look at ProjectTracker you'll see that all the UI types call a Logout() method as they start up, to ensure that the thread has a valid, unauthenticated, principal.

Wbmstrmjb replied on Wednesday, April 08, 2009

Thanks for the response.

But we are getting a Security Exception with an UnauthenticatedIdentity which is wrapped in our own Principal object that inherits from BusinessPrincipalBase. The error is that BusinessPrincipalBase is required and not Generic. I thought maybe the Authenticated piece was the issue. Now it doesn't look that way.

RockfordLhotka replied on Wednesday, April 08, 2009

Before making a data portal call to create the identity, you must set the
current principal on the client to a subclass of BusinessPrincipalBase -
typically with some client-created unauthenticated identity object.

Rocky

Wbmstrmjb replied on Thursday, April 09, 2009

Calling logout fixed it! Thanks.