Silverlight RIA Services - how to do Windows Authentication?

Question

I am building my first Silverlight 3 + RI Services application and need some help.
It will be deployed in an controlled corporate intranet, 100% windows clients. I have started from the Silverlight Business Application template.
These are my requirements:

1. Upon launch the application needs to recognize the currently logged-in user.
2. The application needs to have access to other properties of the user in AD, such as email, full name, and group membership.
3. Group membership is used to grand certain features in the application.
4. A "login as a different user" link is to be always available - Some machines are available throughout the enterprise, logged-in as a certain generic user (verified by the absence of certain membership groups). In this case one can enter credentials and log in (impersonate) to the application as a user different from the one already logged-into the machine.
5. This user is to be used in service calls

I have modified the following in the default Business Application template:

1. App.xaml: appsvc:WindowsAuthentication instead of the default FormsAuthentication
2. Web.config: authentication mode="Windows"

With these modifications I resolve requirement #1 (get the currently logged-in user). But when I examine RiaContext.Current.User, I don't have access to other properties from AD, such as group memberships. How can I achieve my other requirements?

Thanks for your help.

Answer 1

In order to do this you will have to write your own Profile Provider and then modify the user class to include these profile properties which you can then access.

Have a look at page Section 13.3 of the RIA Services Overview document and let me know if you need any help.

We are just in the middle of implementing a RIA Services application and have written our own custom membership provide and profile provider so let me know if you need a hand.

Answer 2

Hey everybody, there's a new article up on MSDN, I'm working through it now.

http://msdn.microsoft.com/en-us/library/ee707353(VS.91).aspx

Answer 3

Here is how I have hacked it on the AuthenticationService provided by BusinessApplicationTemplate.

 [EnableClientAccess]
    public class AuthenticationService : AuthenticationBase<User> {

    protected override User  GetAuthenticatedUser(System.Security.Principal.IPrincipal principal)
    {
        User user = base.GetAuthenticatedUser(principal);
        Configuration config = WebConfigurationManager.OpenWebConfiguration("~");
        SystemWebSectionGroup grp = (SystemWebSectionGroup)config.GetSectionGroup("system.web");
        AuthenticationSection auth = grp.Authentication;
        if (auth.Mode == AuthenticationMode.Forms)
        {
        }
        else if (auth.Mode == AuthenticationMode.Windows)
        {
            string[] a = user.Name.Split('\\');
            System.DirectoryServices.DirectoryEntry ADEntry = new System.DirectoryServices.DirectoryEntry("WinNT://" + a[0] + "/" + a[1]);
            string Name = ADEntry.Properties["FullName"].Value.ToString();
            user.Name = Name;
        }
        return user;
    }
}