using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using Microsoft.SharePoint.Portal;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;
using Our.SSO;
using Microsoft.SharePoint.Utilities;
using System.Web;
using Microsoft.SharePoint;
using Microsoft.SharePoint.WebControls;
namespace ADOTest
{
public class ADOTesting : System.Web.UI.Page
{
protected Button btnDemo;
private SPWeb _myTeamSite;
protected TextBox txtUpdate;
protected TextBox txtDelete;
protected override void OnPreInit(EventArgs e)
{
base.OnPreInit(e);
string pageName = Page.AppRelativeVirtualPath.Substring(
Page.AppRelativeVirtualPath.LastIndexOf('/') + 1);
_myTeamSite = SPControl.GetContextWeb(Context);
MasterPageFile = _myTeamSite.MasterUrl;
}
protected void onSelectClick(object sender, EventArgs e)
{
if (SSOValidation.UseSSO())
{
SSOUserCredentials cred = SSOUserCredentials.GetUserCredentials(ConfigurationManager.AppSettings["SqlApplicationDefinition"]);
if (cred != null && cred.NotFoundUrl == null)
{
Response.Write("<br>Before Impersonation Thread UserName " + System.Threading.Thread.CurrentPrincipal.Identity.Name);
Response.Write("<br>Before Impersonation HttpContext UserName " + HttpContext.Current.User.Identity.Name);
using (new Impersonator(cred.UserName, cred.Domain, cred.Password, SSOValidation.SqlServerIsLocal() ? LogonType.LOGON32_LOGON_NETWORK : LogonType.LOGON32_LOGON_NEW_CREDENTIALS, LogonProvider.LOGON32_PROVIDER_WINNT50))
{
Response.Write("SSO UserName " + cred.UserName);
Response.Write("<br>Thread UserName " + System.Threading.Thread.CurrentPrincipal.Identity.Name);
Response.Write("<br> HttpContext UserName " + HttpContext.Current.User.Identity.Name);
SelectSqlTest ();
}
Response.Write("<br>After Impersonation Thread UserName " + System.Threading.Thread.CurrentPrincipal.Identity.Name);
Response.Write("<br>After Impersonation HttpContext UserName " + HttpContext.Current.User.Identity.Name);
}
else if (cred != null && cred.NotFoundUrl != null)
{
SPUtility.Redirect(cred.NotFoundUrl, SPRedirectFlags.UseSource, HttpContext.Current);
}
}
else
{
SelectSqlTest();
}
}
protected void onInsertClick(object sender, EventArgs e)
{
if (SSOValidation.UseSSO())
{
SSOUserCredentials cred = SSOUserCredentials.GetUserCredentials(ConfigurationManager.AppSettings["SqlApplicationDefinition"]);
if (cred != null && cred.NotFoundUrl == null)
{
using (new Impersonator(cred.UserName, cred.Domain, cred.Password, SSOValidation.SqlServerIsLocal() ? LogonType.LOGON32_LOGON_NETWORK : LogonType.LOGON32_LOGON_NEW_CREDENTIALS, LogonProvider.LOGON32_PROVIDER_WINNT50))
{
InsertSqlTest ();
}
}
else if (cred != null && cred.NotFoundUrl != null)
{
SPUtility.Redirect(cred.NotFoundUrl, SPRedirectFlags.UseSource, HttpContext.Current);
}
}
else
{
InsertSqlTest();
}
}
protected void onUpdateClick(object sender, EventArgs e)
{
if (SSOValidation.UseSSO())
{
SSOUserCredentials cred = SSOUserCredentials.GetUserCredentials(ConfigurationManager.AppSettings["SqlApplicationDefinition"]);
if (cred != null && cred.NotFoundUrl == null)
{
using (new Impersonator(cred.UserName, cred.Domain, cred.Password, SSOValidation.SqlServerIsLocal() ? LogonType.LOGON32_LOGON_NETWORK : LogonType.LOGON32_LOGON_NEW_CREDENTIALS, LogonProvider.LOGON32_PROVIDER_WINNT50))
{
UpdateSqlTest ();
}
}
else if (cred != null && cred.NotFoundUrl != null)
{
SPUtility.Redirect(cred.NotFoundUrl, SPRedirectFlags.UseSource, HttpContext.Current);
}
}
else
{
UpdateSqlTest();
}
}
protected void onDeleteClick(object sender, EventArgs e)
{
if (SSOValidation.UseSSO())
{
SSOUserCredentials cred = SSOUserCredentials.GetUserCredentials(ConfigurationManager.AppSettings["SqlApplicationDefinition"]);
if (cred != null && cred.NotFoundUrl == null)
{
using (new Impersonator(cred.UserName, cred.Domain, cred.Password, SSOValidation.SqlServerIsLocal() ? LogonType.LOGON32_LOGON_NETWORK : LogonType.LOGON32_LOGON_NEW_CREDENTIALS, LogonProvider.LOGON32_PROVIDER_WINNT50))
{
DeleteSqlTest ();
}
}
else if (cred != null && cred.NotFoundUrl != null)
{
SPUtility.Redirect(cred.NotFoundUrl, SPRedirectFlags.UseSource, HttpContext.Current);
}
}
else
{
DeleteSqlTest();
}
}
private void SelectSqlTest()
{
try
{
SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["HillyardCCAPConnectionString"].ToString());
SqlCommand command = new SqlCommand("select SYSTEM_USER", con);
con.Open();
Response.Write("<br>Connection String " + con.ConnectionString);
SqlDataReader reader = command.ExecuteReader();
while (reader.Read())
{
Response.Write("<p>" + reader[0].ToString() + "</p>");
}
con.Close();
}
catch (Exception x)
{
Response.Write("<p>" + x.Message + "</p>");
}
}
private void InsertSqlTest()
{
try
{
SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["HillyardCCAPConnectionString"].ToString());
string insertStatement = string.Format("INSERT INTO tbl_Users (usrNmSh, usrNm, usrNmMdl, usrIsSys, usrSysUsr, usrPhn1, usrPhn2, usrPhnCls1VldlstID, usrPhnCls2VldlstID, usrEml ) VALUES ( '{0}', '{1}', '{2}', {3}, '{4}', '{5}', '{6}', {7}, {8}, '{9}' )","UserNameShort","UserName","UserNmMDL",0,"InsertedUser","","",0,0,"mail@nuvek");
SqlCommand command = new SqlCommand(insertStatement, con);
con.Open();
SqlDataReader reader = command.ExecuteReader();
while (reader.Read())
{
Response.Write("<p>" + reader[0].ToString() + "</p>");
}
con.Close();
}
catch (Exception x)
{
Response.Write("<p>" + x.Message + "</p>");
}
}
private void UpdateSqlTest()
{
try
{
string updateStatement = string .Format ("UPDATE tbl_Users SET usrNmSh = '{0}', usrNm = '{1}', usrNmMdl = '{2}' WHERE usrID = {3}","UpdatedNameshort","UpdatedName","UpdatedMiddleName",txtUpdate .Text );
SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["HillyardCCAPConnectionString"].ToString());
SqlCommand command = new SqlCommand(updateStatement, con);
con.Open();
SqlDataReader reader = command.ExecuteReader();
while (reader.Read())
{
Response.Write("<p>" + reader[0].ToString() + "</p>");
}
con.Close();
}
catch (Exception x)
{
Response.Write("<p>" + x.Message + "</p>");
}
}
private void DeleteSqlTest()
{
try
{
string deletestatement = string.Format ("UPDATE tbl_Users SET usrDelSts = 1 WHERE [usrID] = {0}", txtDelete.Text);
SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["HillyardCCAPConnectionString"].ToString());
SqlCommand command = new SqlCommand(deletestatement, con);
con.Open();
SqlDataReader reader = command.ExecuteReader();
while (reader.Read())
{
Response.Write("<p>" + reader[0].ToString() + "</p>");
}
con.Close();
}
catch (Exception x)
{
Response.Write("<p>" + x.Message + "</p>");
}
}
}
}
--------------------------------------------- Impersonator [From Metadata]-----------------------
using System;
namespace Our.SSO
{
public class Impersonator : IDisposable
{
public Impersonator();
public Impersonator(string userName, string domainName, string password);
public Impersonator(string userName, string domainName, string password, LogonType logonType, LogonProvider logonProvider);
public void Dispose();
public void Impersonate(string userName, string domainName, string password);
public void Impersonate(string userName, string domainName, string password, LogonType logonType, LogonProvider logonProvider);
}
}
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
by: mcdown75Posted on 2009-08-07 at 10:54:26ID: 25045335
Are you using the User ID to control what portions of the DB the users can see? I am trying to figure out why you are passing the UserID and password to the database instead of creating an application user and placing that in the SQL Server security and connecting uniformly from the website.
The problem with the way you are doing it is that you are not issuing a logout command when the user leaves the web site or finishes the command. Just because you dispose/close the con object does not mean the authentication is released. This will often be the case since the web is a stateless connection. Users will drop due to many reasons and won't have an opportunity to issue a logout command. That is why the standard practice is to create a user in SQL Server Security and use that to authenticate the connection from the web server. This would not inhibit using the impersonate on the website and using AD to control user access.
Help me understand a bit more why you need to do it this way.