ArcGIS Resource Center

We are pleased to announce the release of version 1.0.1 of the ArcGIS Viewer for Silverlight. This is a quick-turnaround maintenance release to fix critical bugs that have been identified since the release of version 1.0. The Viewer team has worked hard to address these issues quickly in order to minimize their impact on your Silverlight Viewer applications. The issues addressed include:

• ArcGIS Viewer for Silverlight Applications do not load on Windows XP clients if data containing characters with diacritical marks (e.g. ü, ä, ñ, etc) is included in the map
• Several localization issues related to the forthcoming localized releases of the Viewer

Continue reading »

• How to: Implement Simple Forms Authentication
• How To Implement Forms-Based Authentication in Your ASP.NET Application by Using C#.NET
• Securing your Silverlight Applications
• Forms Authentication Using An XML Users File

Securing the Application Builder and published Viewer application

The process for using forms-based authentication to secure both the Application Builder and a published Viewer application is very similar. The instructions presented here are applicable to both scenarios.

To secure the Application Builder and a published Viewer application with forms-based authentication, three files are required: the Web.config file, a Login.aspx page, and a Default.aspx page. These files need to reside in the application root directory, whether that is the Builder root directory (e.g. \Inetpub\wwwroot\Builder) or the Viewer application root directory (e.g. \Inetpub\wwwroot\Apps\Earthquakes).

Application Builder

For the Application Builder, the Web.config and Default.aspx files already exist in the root directory, but need to be modified. The Web.config file will be modified using IIS Manager. The Default.aspx file will be modified using a basic text editor. The Login.aspx file does not yet exist, so you will create it using a basic text editor.

Published Viewer application

For a published Viewer application, there is an existing Index.htm file in the root directory that will become the Default.aspx page. The Web.config file will be created using IIS Manager. As with the Application Builder, the Login.aspx file will be created using a basic text editor.

Web.config

1. Open Internet Information Services (IIS) Manager and navigate to the virtual directory containing your application (for example, Sites>Default Web Site>Builder). If you are configuring security for a published Viewer application, right-click the folder containing the application and click Convert to Application. Click OK on the Add Application dialog.
2. Double-click Authentication in IIS Manager and set Forms Authentication and Anonymous Authentication to Enabled.
   
3. Return to the virtual directory and double-click .NET Authorization under the ASP.NET heading. Under Actions on the right side of the IIS Manager window, click Add Deny Rule.
4. In the Add Deny Authorization Rule dialog, select Specified users and type a question mark (“?”). Click OK. This denies access to Anonymous users.
   

   Note: If you are unable to use IIS Manager, you may copy and paste the following text in to the web.config file:

   <?xml version="1.0" encoding="UTF-8"?>
     <configuration>
      <system.web>
        <authentication mode="Forms" />
        <authorization>
         <deny users="?" />
        </authorization>
      </system.web>
     </configuration>

Default.aspx

1. If you are configuring security for a published Viewer application, locate the Index.htm file in the root directory and rename this file to Default.aspx before continuing with these steps. If you are configuring security for the Application Builder, the Default.aspx file already exists in the root directory.
2. Open the existing Default.aspx file in Notepad or a similar text editor. The Default.aspx file is the requested, protected resource. In the case of the Application Builder, the Default.aspx is the default Welcome page that is shown when the Application Builder is started.
3. Add the following header at the top of the Default.aspx file to specify the programming language that is used for the server-side code:

   <%@ Page Language="C#" %>

4. Add a Label for the Welcome message and a Button to allow the user to Sign Out of the application. Place the elements shown below directly above the <div id=”silverlightControlHost”> element. The Welcome message and the Sign Out button will display at the top of the Application Builder.

   <asp:Label ID="Welcome" runat="server" />
   <asp:Button ID="Submit1" OnClick="Signout_Click"  Text="Sign Out" runat="server" />

5. Add the following script after the closing </head> element and before the opening <body> element. This script displays a Welcome message to the user and redirects the user to the main Login page when they click the Sign Out button.

   <script runat="server">
      void Page_Load(object sender, EventArgs e)
      {
         Welcome.Text = "Hello, " + Context.User.Identity.Name;
      }
      void Signout_Click(object sender, EventArgs e)
      {
         FormsAuthentication.SignOut();
         Response.Redirect("Login.aspx");
      }
   </script>

Login.aspx

The Login.aspx file does not exist in either the root directory of the Application Builder or a published Viewer application. There are many options for designing a login page, but the following is an example of a simple form containing two text boxes (User Name and Password) and a Submit button that is presented to the user. The user enters the user name and password, and then clicks Submit. The code then compares this name and password to the pair that is hard-coded into the Login.aspx file. If the comparison succeeds, the user is connected to Default.aspx. If it fails, an error message is presented to the user.

1. Open Notepad or a similar text editor and copy the text below into the empty file.
2. Save the file as Login.aspx in the Application Builder or published Viewer application root directory.

   <%@ Import Namespace="System.Web.Security" %>
     <html>
       <head>
         <style type="text/css">
           .auto-style1 {
           font-family: "Microsoft Sans Serif";
           }
           .auto-style3 {
           font-size: small;
           }
           .auto-style4 {
           font-size: small;
           font-family: "Microsoft Sans Serif";
           }
           .newStyle1 {
           font-family: "Microsoft Sans Serif";
           padding: inherit;
           margin: auto;
           }
         </style>
       </head>
   <script language="C#" runat="server">
   void Logon_Click(Object sender, EventArgs e)
   {
     if ((UserName.Value == "user1") && (Pass.Value == "password"))
     {
       FormsAuthentication.RedirectFromLoginPage(UserName.Value, Persist.Checked);
     }
     else
     {
       Msg.Text = "Invalid Credentials: Please try again.";
     }
   }
   </script>
   <body bgcolor="#FFFFFF">
   <form runat="server" class="auto-style1">
   <h3 class="auto-style1">ArcGIS Viewer for Silverlight</h3>
   <table>
    <tr>
     <td class="auto-style4" style="height: 30px">User:</td>
     <td style="height: 29px">
      <input id="UserName" type="text" runat="server" class="auto-style3"/>
     </td>
     <td style="height: 29px">
      <asp:RequiredFieldValidator ControlToValidate="UserName" Display="Static" ErrorMessage="Cannot be empty."
       runat="server" Font-Size="Small"/>
     </td>
    </tr>
    <tr>
     <td class="auto-style4" style="height: 30px; bottom: 5px;">Password:</td>
     <td style="height: 29px">
      <input id="Pass" type="password" runat="server"/>
     </td>
     <td style="height: 29px">
      <asp:RequiredFieldValidator ControlToValidate="Pass" Display="Static" ErrorMessage="Cannot be empty."
       runat="server" Font-Size="Small"/>
     </td>
    </tr>
    <tr>
     <td style="height: 29px; top: auto;" class="auto-style1">
      <span class="auto-style3">Remember me</span>:
     </td>
     <td style="height: 28px">
      <asp:CheckBox id="Persist" runat="server" autopostback="true" Font-Size="Small"/>
     </td>
     <td style="height: 28px"></td>
    </tr>
   </table>
   <asp:Button ID="Submit1" OnClick="Logon_Click" Text="Log On"
   runat="server" />
   <p>
     <asp:Label ID="Msg" ForeColor="red" runat="server" />
   </p>
   </form>
   </body>
   </html>
   
   

This post provides an example of using ASP.NET forms-based authentication to secure the ArcGIS Viewer for Silverlight. ASP.NET forms-based authentication is a common way to secure Silverlight applications that involves validating a user’s credentials (user name and password) and then redirecting to the application. Both the Application Builder and resulting Viewer applications may be secured, and as demonstrated here, the process is essentially the same for each. The links listed at the beginning of this post provide additional information on securing Silverlight applications and implementing forms-based authentication.

Katherine Dalton
Esri Product Engineer
ArcGIS Viewer for Silverlight