在Windows应用程序上使用自定义身份验证可以采取哪些预防措施？

Question

I am writing a new version of a Delphi app in WPF/MVVM. It is not a complete redesign from the ground up, but rather just replacing Delphi code with WPF code, with a few modernization changes. I currently only have access to the running Delphi app, not source, but will have that soon.

Currently authentication uses a database query for a user name and hashed - I suspect it's not quite one way, but must address that later than today - password. How do I store that a user is authenticated, to check for access to all application commands and data? A simple private boolean in the User view model, an instance which is contained in the top level, application, view model? Or maybe when I extend to authorization, simply the fact that the User view model has been allocated a null list of permissions? What is normally done here?

The application is an access control and time and attendance management app for a very large international corporation, so security levels need be fairly high. Using AD is not feasible at this point due to the equally massive user base and list of access rights, and the rewrite is on very high priority.

Answer 1

Not a simple question, actually.

This doesn't fit as a comment, so I'm posting this as an answer:

• what is the architecture of your application? 2-tier? 3-tier?
• are you using WCF for the communication?
• who are the users of your application? Windows users?
• from where is your application used? In a Windows domain? Over the Internet?

Those questions might help you decide which way to go.

For example, if you're using 3-tier architecture, WCF for the communication, application used on a Windows domain, you might be interested in a non-custom authentication (you could use Windows authentication). See MSDN (Authentication, Authorization, and Identities in WCF) .