Custom Membership, Role and Profile: Silverlight RIA Service

How to enable your Silverlight 3 Application for RIA Services and use the built-in support for your custom Membership, Role and Profile providers.

f you haven't had a look at Silverlight RIA Services yet, I'd recommend it. This infrastructure simplifies two-way data access via services with Silverlight, and includes support for Membership, Roles and Profiles. It really represents a big step in the right direction for simplifying bidirectional data access and business logic, especially with Silverlight.

In this article I will illustrate how to "hook up" your Silverlight Application for authentication via Membership, authorization with Roles, and the ability to save user-entered Profile data. I will use a modified version of the Altairis classes that are available on codeplex.com. This means we will only have four tables added to our database - Users, Roles, UsersInRole, and Profiles. All the data is stored in visible columns which makes it easy to search the profiles table, for example, for all those users who want to receive your email newsletter. There are no stored procedures involved.

You will first need to install the RIA Services preview. I recommend that you also download the accompanying PDF, which provides a lot of detail, and plenty of good code samples. We start by creating a new Silverlight Project. Note the new checkbox at the bottom of the New Application dialog:

Checking this Link Option is what enables your project for the magic of RIA Services, along with support for ASP.NET Membership, Roles and Profiles. In my UnBlog post here, I provifde a number of additional resource links that "didn't make it" into the MIX '09 presentations. Check them out, please.

In the web.config, we need to enable the custom providers with the requisite elements:

You can see above that with the custom Profile provider I use, we can actually define the fields that match up with our Profile Table. Unlike the opaque way data is stored in the default provider that ships with ASP.NET, all our "stuff" is visible in columns that are easily SQL-searchable.

Now we need to create the server-side Service class that RIA will magically pick up and create a Silverlight proxy for:

We need an AuthenticationService, a User class, and a MembershipService. All these need the [EnableClientAccess] attribute, and methods within them need the [ServiceOperation] attribute.

One other thing, we need to change the Silverlight control on the ASPX page to host the User DataContext that enables our Silverlight controls to be "user aware":

I don't do any data binding in this sample, but the above lines are your key to two-way databinding with your Silverlight controls when RIA Services is used.

That takes care of the Server side. Whenever you do anything to your AuthenticationService class and save it or build the app, a generated proxy class called (In this case) SLRIAAuth.Web.g.cs is regenerated in your Silverlight application. You'll need to enable "Show all Files" at the top of the Solution Explorer window to see this. I generally bring it into the project to get Intellisense. This will also clear up some VS / Resharper errors related to the fact that the generated class file was not "included the project".

In the Silverlight Application, you should see something new in the App.xaml file:

This is what identifies our service proxy so we can code against it. Now here is what I do in MainPage.xaml.cs:

We have a _service variable that is used to hold a reference to our proxy Service, then use the UserContext to handle a normal call to the Login method. The sample database SQL script installs a single user, "admin" with password "admin". In the LoginCompleted event handler, I pop up a MessageBox showing that the user was authenticated, and their role. Finally, I add the Profile properties for the user and call _service.SaveUser(); The SaveUserCompleted handler shows the results. And, if you go look in your database Profiles table, you'll see that indeed, this user's profile data, which was not in the Profile table after you ran my table script, has been saved. In a real app, you would of course have nice Login and User Profile forms and so on; this sample is just a "proof of concept".

You can download the complete Visual Studio 2008 Silverlight 3 solution here. Be sure to create a database "TEST", and run the provided SQL Script to populate it. You can do a lot more with Silverlight RIA Services, this is just the beginning.

It is easy for developers to be intimidated by the complexity of some of these new offerings. Silverlight RIA services is relatively easy to learn, and it brings a great deal of new power to you as a Silverlight developer. The March MIX 09 preview does everything it is supposed to do, and it works. The newest May '09 preview fixes bugs, and is even more stable. The addition of RIA Services to Silverlight applications moves Silverlight 3 into a whole new realm for developers of LOB Silverlight applications. In particular, have a look at the "Shared" classes option which allows you to automatically replicate server-side entities into the Silverlight client. If you take the time to study this, as I have, you should definitely get "religion" about what Silverlight 3 and RIA Services is going to offer!

That was very quick thanks so much.

Rachida

Hi Peter,

Thanks for the article, very useful. I've extended the provider to use my EntityDataModel but one thing I'm stuck on is how to encrypt/hash the password in Silverlight app and then decrypt when received on the Server. I'm guessing I should create some kind of shared class but I'm not sure about duplicating the machine key that is used for encoding.

Any ideas?

Thanks,

Sean.

Hi Peter,

Thanks for the great articles.  However I've hit a snag with this one.  I'm using a combination of RIA and the default ASP.Net membership provider.  As in your first article on this subject (http://www.eggheadcafe.com/tutorials/aspnet/7cc2760f-50f2-492d-9d62-48ad5c7f70b4/aspnet-membership-and-ro.aspx) I am using web.config to limit access to only SLRIAAuthTestPage.aspx and ClientBin/SLRIAAth.xap.  Everthying else is set with <deny users="*">.

The problem is that the Silverlight is now denied access back to the RIA web service.  It is not clear to me the service filename to allow access to.  In the original article above you used WebServices/AuthenticationService.svc

However, in the RIA model I do not have a .svc file to grant unauthroized access to.

Thanks greatly for your help.

Paul

Hi Piter!

I have a problem and would like to know if it can be sold using RIA Services.

The project which I'm currently working does not allow user multiple entries to the system. As a solution we are using session concept. For example when user login it’s open session which will be closed on logout. Before actual login application should check if this user has any open session and asking him to close it if it’s open.

I would be really appreciated for any help.

Thank you.

http://code.msdn.microsoft.com/SilverlightMD5

This *should* match the FormsAuthentication "HashPasswordForStoringInConfigFile" method as long as MD5 algorithm is used.