ASP.NET Server Control Authorization

Release Date: 4/1/2004

| Update Date: 4/1/2004

Summary: Understand the authorization requirements for the ASP.NET server control, understand the ASP.NET control implementation available for .NET Framework version 1.0 and 1.1. This implementation can be extended to create a custom server-side authorization scheme. (23 page print pages)

Nikhil Kothari Microsoft ASP.NET Group

Vandana Datye Freelance

July 2003

Applicable to: Microsoft? ASP.NET

Please download AspnetControllicensing.msi.

background

This article assumes that the reader is familiar with the Microsoft? ASP.NET programming and the ASP.NET server control.

All rights. This part of the content is licensed by Microsoft Press. For more information about the book, see http://www.microsoft.com/mspress/books/5728.asp.

This page

Introduction ASP.NET Server Control Requirements Authorized Control Drive. Net Framework Authorized Structure ASP.NET Server Control Authorized Infrastructure Extension Default Authorization Program Expiral License Program Encryption Program Authorization Remindrical List Summary

Introduction

The Microsoft .NET framework has a built-in scalable authorization structure that supports all managed components (including business objects, Windows Form Controls, and ASP.NET Server Controls) to authorize and rule. This article is based on this structure to provide authorization implementations specifically for ASP.NET controls, and you can extend the authorization implementation to create custom licensing programs, such as:

• Simple Authorization Scheme - Only check whether there is a valid license data to determine if the control is enabled. • Permits expirations after each use of authorization scheme - after a use count. This solution can be used for the demo version of the control. After the license expires, the application developers can register (and purchase) your control and receive a not permission. • An ASP.NET server control is enabled only when requesting from a particular client (such as a local computer). This program can be used to implement the trial version of the control. • Rely on encryption to prevent application developers from performing license data spoofing.

Back to top

ASP.NET server control authorization requirements

ASP.NET Server Controls Authorization Program must meet the following requirements:

• Support for non-compilation schemes. ASP.NET web applications often use dynamic compilation models, so there is no set of precompiled assessments associated with the application. The authorization mechanism should not rely on the license as an assembly resource embedded in the program set. • Support runtime licenses. Page developers use a visual design tool and simple text editor to develop their own pages. The authorization mechanism cannot rely on design, and must provide runtime verification. Moreover, the runtime authorization implementation should not have dependencies with any (optional) design. • Support license caching mechanisms. Ideally, each application should only retrieve a license data instead of being retrieved for each page request, because the retrieval logic will involve a large overhead, for example, open the file and decrypt information. The license should be created when you need to permit, and a cache is made so that you will be reused on the server later. You can still authenticate the license for the cache when you use the license to implement the license based on the license. • Support XCOPY deployment. ASP.NET allows page developers to deploy their web applications by copying files between computers on the network. Authorization schemes should not rely on registry, or other-specific computed-based resources that are prohibited from deployment. For the sake of simplicity, we use the server control in the previous list. However, authorization requirements apply to all ASP.NET server components. Similarly, the ASP.NET control authorization scheme described herein also applies to other ASP.NET server components.

Back to top

Authorized control drill

Control authorization involves three key elements:

• Support for authorized code • License data • Check license data, issue licenses and certification licenses when using controls

Authorized server control

The LicensedLabel server control listed below is derived from the ASP.NET System.Web.ui.WebControls.label control and adds authorization support. The authorization function is provided with the code displayed in a bold.

// licensedlabel.cs

//

Using system;

Using system.componentmodel;

Using system.Web.ui.webcontrols;

Namespace licensedControls {

[

LicenseProvider (TypeOf (ServerLicenseProvider)

]

Public class licensedlabel: label {

Public licensedlabel () {

LicenseManager.validate (TypeOf (licensedLabel));

}

}

}

This example illustrates to support the authorization, you must add the following to the code of any server components:

• In the constructor's constructor, call the System.comPonentModel.LicenseManager class Validate, and transfer it as a parameter to the component's type. If the control does not have a valid license, the Validate method of the licenseManager will trigger System.comPonentModel.licenseException. Another method is that in the constructor, you can call the static method isvalid for the LicenseManager class, so it will not cause an exception. If you want to enable controls in the case where there is no valid license (so on the simple version), call the IsValid method. • Apply System.ComponentModel.licenseProVideRATITRIBUTE metadata properties to your component and deliver the type of license provider (from System.comPonentModel.licenseProvider). The ASP.NET Server Control Authorization Infrastructure section shows the implementation of the license provider ServerLicenseProvider for the licensedlabel control. As shown in Figure 1, changes you must do for controls for authorizations are minimal. The real authorization function is in the license provider class, and later describes this part.

If you have implemented licenses in the Windows Form Control, you may be surprisingly found that LicensedLabel does not leave its license. This is because LicensedLabel uses a license provider that caokes the license on the server.

License data

The license data provides information on authenticating and merging to the license by the authorization structure. You can provide license data in many different ways (such as expiration, counting or unique key). The type and location of license data is specified by a specific authorization scheme. License data is usually provided in the file that extension .lic. The license data of the LicensedLabel control in Figure 1 is located in a file called licensedControls.licensedLabel.lic, which contains only text "licensedControls.LicensedLabel is licensed".

Use the authorized control on the page

The ReadMe documentation provided as the code example of this article describes how to build these examples.

Use the licensedlabel control in the page

1. Copy the licensedControls assembly (including the licensedLabel control) to the application's / bin directory. This step is required if you use Microsoft Visual Studio .NET and add a reference to the licensedControls project in your web application project.

2. Copy the licenseDControls.licensedLabel.lic file to the application's licensees / licensedControls / 1.0.0.0 directory.

Now, you should use controls from any page in your application.

The following code shows a page that uses the LicensedLabel control.

<% @ Page language = "c #"%>

<% @ Register tagprefix = "lc" askSEMBLY = "licensedControls"

Namespace = "licensedControls"%>