How much logic can/should be put in an Virtual Role? We have need of using quite complex Virtual Role that depends on a dynamic property.
The sceneario is this:
We have made an custom membership provider to be able to authenticate users against our own database containing several thousands of user wich we do not want to integrate in EPiServer.
To be able to set access rights on those we created a virtual role wich checks that the login name follows a certain regular expression. So far everything works fine and the users can log in and is part of the Virtual role.
We then needed to extend the virtual role to check a dynamic property on pages and by adding the following code the virtual role causes a stackoverflow:
int pageId = int.Parse(HttpContext.Current.Request.QueryString["id"]);PageData page = EPiServer.DataFactory.Instance.GetPage(new PageReference(pageId));int projectId = int.Parse(page["ProjectId"].ToString());
There are even more logic that needs to be added to the Virtual role but since it throws exception even at this point we hadn't went any further. The Virtual role has to check our databse if the user is authorized to see the pages with a certain project id.
Is this to much logic or is something wrong with the code or is there a much more effecitve way to do this?
If you are not using R2, try with this line.
...PageData page = EPiServer.DataFactory.Instance.GetPage(new PageReference(pageId), EPiServer.Security.AccessLevel.NoAccess);...
Then it hopefully will ignore the VirtualRole-check when you need to get the dynamic-property.
worked like a charm. I tried some of theese but not the noaccess one, typical.
Seems weird that the was no errormessage when trying to access the page. The procedure just restarted over and over again.
How will this change in R2?
In R2 the security check when using GetPage is removed, and you have to do it by your self.
Nice in some cases (like this maybe?), and in some other cases it's a real pain.