RIA Services: custom autorization

Question

Here is a good example how to create custom autorization for RIA services: http://stackoverflow.com/questions/1195326/ria-services-how-can-i-create-custom-authentication

In my case a silverlight-pages will be displayed as a part of HTML-content and user authorisation is already implemented on the server-side (ASP.NET Membership is not used). It is required to show on the silverlight pages different information for authorised and non-authorised users.

Is there any possibility to track on the Silverlight side if user is already authorized on the server side (on the usual ASP.NET web-site)?

Please adivse how to do this.

Thank you in advance.

Answer 1

Several ways:

1. The simplest: if authentication results in a reload of the page (and therefore all the Silverlight apps), you can send an "IsAuthenticated" parameter value to the Silverlight application through a <param name="IsAuthenticated" value="<%= IsAuthenticated %>" /> tag in the app's <object> tag (in the loading HTML), or through the InitParameters method of the asp:Silverlight object, whichever one you're using; the parameter will be visible to the SL app in the InitParams member of the StartupEventArgs sent to the handler of the Application's Startup event.

2. More complex: create a WCF HTTP Web Service (i.e. one that Silverlight can see) that contains a method that returns the user's current authentication status.

Of course, this only tells the SL app whether the user's authenticated, and does not help to lock down whatever information you're sending to the app -- in other words, the server should still check that the "authenticated-only" information is only being returned to requests from SL apps running in authenticated browser sessions. (Assuming that information is related to the authentication. If it's just a different set of banner ads, then no big deal.)