.NET App Security: Role-based Access Control for Entity Framework & ASP.NET

Enterprise-Ready Role-based Access Control (RBAC) & User Authentication

While certain platforms (like ASP.NET) simplify authentication and basic authorization with built-in design time APIs, it's difficult to construct a flexible/customizable app security system (with the ability to customize the system once the app is deployed). Our Role-based Access Control (RBAC) & User Authentication API for .NET allows you to incorporate a highly flexible/customizable security system in your next .NET app.

LOB app developers want to save time and do not want to implement complex security memberships and authentication/authorization algorithms from scratch (such as apps that can filter protected data against a user's access rights or check whether the current user is allowed to delete records). Our Role-based Access Control & User Authentication API for .NET allows you to incorporate advanced security-related capabilities with minimal effort.

Getting security right (safe, fast, up-to-date, flexible, and database agnostic) is complicated. Pre-built middleware libraries like ASP.NET Core Identity or Identity Server can be difficult to configure or offer unnecessary functionality. Our Role-based Access Control & User Authentication API for .NET allows you to integrate a proven, database agnostic security sub-system in the shortest possible time.

Target Audience & Common Usage Scenarios

XAF developers who need to create non-XAF .NET apps.

If you want to reuse data models and security settings/configurations (users, roles and permissions) stored within an existing XAF application database, look no further than XAF's Role-based Access Control & User Authentication API for .NET.

Based on feedback, we know that many XAF developers create custom web and mobile UI clients to service various internal administrative tasks (data modifications, report generation, scheduled workflows). XAF's Security System is perfect for such usage scenarios.

Non-XAF developers who create standard line-of-business (LOB) apps.

If your .NET app includes login/logout forms and requires security related functionality, XAF's Role-based Access Control (RBAC) & User Authentication API is an easy-to-use alternative to custom app-security logic.

From WinForms, WPF and ASP.NET, to .NET server technologies like ASP.NET Web API/OData, WCF – XAF's Security System is the perfect choice for the enterprise. And yes, XAF's Role-based Access Control (RBAC) & User Authentication API for .NET will soon support Blazor & Xamarin.Forms (Android, iOS, UWP) UI technologies.

Demo Apps

Minimal dependencies. Your existing ORM knowledge. Secured apps in 3 steps.

Step 1

Reference a few XAF core assemblies from DevExpress NuGet or .NET Installers.

Step 2

Setup the authentication type, create users and roles using examples for target .NET platforms.

Step 3

Execute secured CRUD operations using your ORM database context or its XAF wrapper.

WinForms

A WinForms CRUD app with Ribbon, Data Grid. The app includes list and detail forms within a Tabbed-MDI shell. Download Demo

DevExtreme + ASP.NET Web API OData

A client-side HTML/JavaScript CRUD app that uses the DevExtreme Data Grid and connects to an OData v4 web service (using the ASP.NET Core Web API). Download Demo

ASP.NET Web Forms

A server-side Web Forms CRUD app that uses our high-performance ASP.NET Data Grid. The demo supports inline data editing. Download Demo

Console

A simple console app that connects to a database and outputs data records based on user rights. Download Demo

WPF

Coming soon. Please help us prioritize future development. Take a Survey

Xamarin

A native CRUD mobile app for Android and iOS that connects to the ASP.NET Core Web API service. Download Demo

Blazor

A server-side ASP.NET Core Blazor CRUD app that uses our high-performance Data Grid component. The demo supports inline data editing. Download Demo

ASP.NET Core MVC

A server-side ASP.NET MVC Core CRUD app that uses our high-performance DevExtreme-based Data Grid. The demo supports inline data editing. Download Demo

ASP.NET MVC 5

Coming soon. Please help us prioritize future development. Take a Survey

David Desiderà

More than one year ago I explained to my collaborators that - in my opinion - it was possible to integrate XAF's security layer with UI interface into an existing WinForms enterprise application that was 10 years old. We successfully implemented it! It took 40 man-days of job in total instead of at least 400 if I had decided to start from scratch. You guys saved my life!

Need additional use-cases? Review our advanced user-role management UX for both WinForms and ASP.NET Apps.

Documentation

Web Demos

Free 30-Day Trial

Role-Based Access Control (RBAC)
with Multi-Database Permission Storage

1. Access control permissions (linked to roles and users) that can be stored in more than a dozen popular data stores (including popular database servers like SQL Server, Oracle, PostgreSQL, MySql, Firebird, XML and "in-memory" stores).

Type permissions grant Read, Write, Create, and Delete access to all objects.
Object Permissions work in conjunction with Type Permissions and grant access to object instances that fit a specified criterion.
Member Permissions grant access to specific members unconditionally or based on a criterion.

2. Powerful and easy-to-use APIs to configure users, roles and permissions in code or visually within XAF apps.

3. Support for extensions or replacement with custom user, role, and permission objects.

Role-Based Access Control with Multi-Database Permission Storage - XAF, DevExpress

Authentication

1. Built-in authentication types: Forms (user name/password), Active Directory (Windows user) and Mixed (several authentication providers).

2. A modern and secure algorithm for password generation and validation.

3. Support for extension or replacement with custom authentication strategies and logon parameters. For instance, our popular example shows how to use OAuth2 with Google, Facebook or Microsoft authentication providers.

Authentication - XAF Security System, DevExpress

Authorization

1. Two code lines to filter records against a logged user. With a secured object space provider, your ORM data query and modification API will remain unchanged.

2. Fine-grain access control for object relationships, individual objects or columns with or without criteria (example: can read the Full Name field, but cannot modify Salary).

3. Straightforward APIs to check CRUD or custom access rights for UI customizations (example: mask protected editors or disable menu commands).

4. Proven in production environments. Security permission caching for the best possible performance.

5. Easy troubleshooting with comprehensive documentation, diagnostic tools and DevExpress Support.

Authorization - XAF Security System, DevExpress

Bahalddin Elsayed

Regarding XAF's Security - I want to compare what XAF offers to what we built in our company. We initially sought to create the same structure and the same security system layout as XAF. To complete our custom security system and replicate the feature set available in XAF, required 5 months of development for 2 individuals. Obviously, XAF's built-in security system saves a lot of time, but what I really like about XAF's Security System is that you can hide or protect tables and associated records both horizontally and vertically. XAF's Security System also allows you to limit access to individual record columns unconditionally or by criteria. The beauty of XAF's access control rules is that they can be applied to user groups or roles.

Field Tested Solutions that Work

Proven to save development time

Building and testing a robust security system is not an easy task, especially if your goal is to deliver a fully configurable system and introduce important features such as runtime permission control via an integrated UI.

See Performance Test

App Testing - XAF Security System, DevExpress

Joche Ojeda

One of the things I ask my customers is 'do you really want to develop a security system from scratch?' Experience tells me that when someone really wants to build a security system from scratch, it is because they have never had to build one before. Fact is that if you have built a security system from scratch, you'll definitely want to avoid it.

Need help or require more information?

Announcing DevExpress Universal v21.1

DevExpress Wins 20 Visual Studio Reader’s Choice Awards