- Do we have to install VG and our application software on the same server?

As for ASPX the code will be integrated in the webconfig or in the home page?

If it is a webconfig the code will be integrated in the load form of the application or in another place?

For an ASP .Net application the only thing that you need to do is to change the file web.config by adding the following statement:

Code:


< configuration>
<system.web >
...
<httpModules >
<add type="Novalys.VisualGuard.Security.WebForm.VGHttpModule,Novalys.VisualGuard.Security.WebForm" name= "VGModule"/>
</httpModules >
...
</system.web >
</configuration>




The Visual Guard module will then interpret the loading of the forms and will secure them. There is no need to add code.

If the application uses an authentication mode of Form type you must develop a connexion form that will allow the entry of the user and of the password and to use the following code to validate the authentication:

Code:


C#
if (VGSecurityManager.Authenticate(usernameTextBox.Text, password).IsFailed)
{
…
}
else
{
FormsAuthentication.RedirectFromLoginPage (usernameTextBox.Text, remenberCheckBox.Checked);
}
VB.Net
If VGSecurityManager.Authenticate(usernameTextBox.Text, password).IsFailed Then
' the authentication has failed, show an error…
Else
' Redirect to the url.
FormsAuthentication.RedirectFromLoginPage(usernameTextBox.Text , remenberCheckBox.Checked);
End If




For the applications Winform, VG automatically finds the creation of forms and secures them without adding code. It is only necessary to call the connection window of Visual Guard (or to use yours) when the application is launched.

To secure classes that are not forms you need to add the interface VGISecurable to the class statement and the following code at the end of the class constructer:

Code:


C#
VGSecurityManager.SetSecurity(this)
VB.Net
VGSecurityManager.SetSecurity(this)



Visual Guard .NET - Version 2.7.806.18

Visual Guard can secure a .Net application even if its source code is not available.
This implies an adapted use of Visual Guard.
You can find below more information about how to manage this with the 3 main features of Visual Guard (Authentication, Permissions, Audit), for Winforms and for Webforms.


Authentication with Winforms (2 options)

1. A launcher for all applications
You can develop a Winform application, which will launch one or several winform applications.
The launcher is secured by Visual Guard.
User authentication will be done when the user enters the launcher.
The launcher contains a dynamic menu. The options of the menu corresponds to the applications the user has access to.
The dynamic menu would be adapted by Visual Guard according to the permissions granted to the user.

Limitations:
You need to maintain the content of the menu.
You need to deploy the launcher any time you want to add/remove an application from the menu.

2. A launcher per application
The other option consists in developing a launcher per winform application, secured by Visual Guard.
This launcher would manage user authentication.


Authentication with Webforms

You do not modify the source code.
You modify the configuration files of the website so that authentication is managed by Visual Guard when the user accesses the website.
Permissions for Winform applications
Visual Guard sees the launcher and your winform applications as one unique application.
Even without the code of the application, you can:
• Define permissions: VG Permission Editor can explore the components of the application using the .Net framework reflection mechanism and define technical actions (for example the modification of the property of a visual component).
• At runtime, VG would intercept the windows opened in the winform application and applies the technical actions related to the permissions. This allows acting on the visual elements in the windows of the application (hide a button, or a menu option, etc…)
Permissions for Webform applications.

When the configuration files of the webform application are modified, it allows VG to intercept the pages displayed and to modify the visual elements of the page with the technical actions declared before hand in the permission editor.

You can restrict the access to a directory or folders of the website to some of the users, some roles or some permissions managed by Visual Guard.


Auditing features for Winform

• Anytime someone tries to access an application, you can create an event in the log (whether the log in was successful or not).
• Anytime a page is opened, you can log the access to this specific page with the ID of the user, the time/date, …
• You can log the use of any visual control (who clicked on this button, who opened a menu, etc…

Note: the instruction which allows writing in VG log can not be added to the code of the applications (since we do not have access to the source code).
The instruction would be written in a VG « Script Actions ». When VG detects the event you want to log (for example, an access to the application), the corresponding script action is launched and its code is be executed. It calls VG API to add a line into VG log.
Auditing features for Webform

The same process applies for a web site:
A VG Script Action would add a line in the log for each event you want to track (accessing application, opening a page…)


Visual Guard

Visual Guard .Net implements the standard interface IPrincipal. By default, when Visual Guard .Net authenticates a user, it replaces the current thread principal by its own principal (populated with the list of Visual Guard roles granted to the user). You can use the PrincipalPermission class in your code to check whether a Visual Guard .Net role is granted to the current role.

In ASP.Net context, Visual Guard .Net is compatible with standard URL authorization mechanism and the authorization section of the web.config file. It is also compatible with the LoginView class and SiteMap security trimming and all components based on ASP.Net Membership API.

Visual Guard Version 2.6.709.16