In this video we'll look at how to integrate our XAF security system API into a Blazor
Server application that uses Entity Framework Core for Data Access.
This is part 2 of a series of videos that discusses security for XAF.
To watch the first video, please click on the link in the upper right corner.
Alright.
In Visual Studio, I have my sample Console Application open.
We'll use the code from this in our Blazor application and I'll detail the main integration
steps.
First, we'll create a new project.
Right click on CS and choose Add.....
New Project.
Select the Blazor App template and click Next.
I'll name the project BlazorEFCore and click Create.
Let's just leave all the default settings and finish creating the project.
OK.
Let's set this as the Startup Project and run it to see what the default settings look
like....
Here's the app.
I'll click on Fetch Data, you'll see that it loads data from our sample weather forecast.
Let's delete this since we won't need it.
And then go to WeatherForecastService.
Our Console application already has a data model that we'll need.
The ApplicationDbContext defines the Employee and Department Entities.
We also have XAF specific entities for permissions that come from our DevExpress.ExpressApp.EFCore
nuget package.
And here we also have a Microsoft.EntityFrameworkCore Package installed as well that we'll need
for our application.
Now let's add a dependency into our business class library.
Right click and choose Add Project Reference and select our BusinessObjects Library.
Next we'll need to add dependencies to Microsoft's Entity Framework Core Packages because we'll
access SQL Server.
So I'll copy them here and paste them into my project file.
We'll explicitly add links to our DevExpress packages because they will be easier to edit
since we reference the class library.
We already have a data model and we need to create initial data for this.
Our console application has an updater class that creates all required Employee and Department
data along with the PermissionPolicyUser objects and PermissionPolicyRole.
The next step is to query this data as a user.
Let's copy this code from our console application and add it to the WeatherForcastService.
We'll leave the names as is and edit the code.
Here we need to use return.
Oh.
I forgot, we should also copy the using statements and paste these in to get rid of the warnings.
Here we'd like to use our Employee data.
And also task configuration.
Let's copy the connection string.
As you may know, in ASP.NET core applications, we'll need a special Connection
Strings section that will contain a connectionstring element where we'll paste our string.
And in order to read it, we want to inject an IConfiguration interface that comes from
the Microsoft extensions Configuration Package.
Let's define a property....
And we'll initialize our construction that uses dependency injection.
I'll copy and paste Configuration here.
And we'll call the GetConnectionString method that will return the connection string element.
OK.
We're almost ready.
In here we want to create data.
I'll use the GetObjectsQuery for the Employee data.
And we want to return an array.
Ok.
Let's take a quick look at the code.
First, we'll initialize the security system based on the Authentication Standard and also
our user and role types.
This security system will be used to initialize SecuredEFCoreOjectSpaceProvider that also
accepts the ApplicationDbContext.
As well as connection string information.
This object space provider will be used to create object spaces.
Technically, these are wrappers around DbContext.
In order to show and edit the data, we'll need a login.
For this, we'll call the Logon method of the security system.
And previously, we configured our authentication object to use a username "user" and an empty
password.
Let's save this and edit the pages we have....
In the FetchData.razor page, I'll change the data model type.....
And Customize the output.
We'll want to display Full Name information and department.
I'll delete the others.
I'll repeat the code here as well to retrieve the information.
It's important to note that some users may not have access to certain departments depending
on title.
Ok.
Let's save this and then run it and see how it looks in the browser....
I'll click on Fetch Data and you'll see that only Departments that contain "Development"
are displayed as we coded in the updater class.
It's important to note that the permission information is fully dynamic because it's
stored in the database and we can edit it dynamically.
For example, we can modify information about our permission.
Here we prevent the read access if the title does not contain the word "Development".
I'll change this to "Sale", return to my app and refresh the browser.
And you can see that now only Departments that contain the word "Sale" are shown.
Let's look at this in XAF....
The ability to modify user permissions at runtime is one of the most popular features
of our XAF Security system.
Since you store this information in a database, you can build custom user interfaces and Jetgate
the function of configuration to your application administrators or users with permission.
For instance, In XAF Winforms, WebForms, and Blazor UI we have implemented this capability.
Here is a desktop application that has the ability to edit Type Permissions.
Like here, I can see the permissions for the User.
There are Member Permissions as well as Object Permissions.
And you can modify the criteria as you see fit.
We also have a similar UI for Blazor.
Here you can see the list of roles, as well as permissions, just as it was in the WinForms
app.
And that's it for this video, I hope you enjoyed this look at security permissions with XAF.
If you like this video, give us a thumbs up and don't forget to subscribe and ring the
bell to get notified for future videos.
If you have any questions, you can comment below, or check the documentation.
Thanks for watching and thankyou for choosing DevExpress.