Develop Reference

Giving users roles in a C# WPF, MySQL app?

This is my first project in WPF. My goal is to build a template project that can be duplicated and reused again.
The goal is to build a Central Dashboard with permissions for each page/element in the application, with a login form.
For login and access to different elements of the app, I would like to assign each page a permission_id in the code. Then i want those permissions given to roles and the roles given to user_id.
I have attached an image of the database tables.
Here are my questions:
Q1: How can I link the tables in the database together?
Q2: What is the safest method to connect to a MySQL database in WPF?
Q3: What would i need to do, to show online users to everyone logged into the app?

Q1: Not really sure what you mean, the tables are linked already.
Q2: The safest method would be to create an API and have your WPF app consume that. Accessing the database directly from WPF app is not a good idea, since you're giving your connection string away.
Q3: It'd also be in your API logic, but the simplest way I think is simply to track users that make request and store them in-memory. These "tokens" would need to have some expiry date and refreshing mechanism, and you'd have to remove users whose tokens have expired from the list.

How to use a Certificate in a Winforms Application to Authenticate a User?

I have a Winforms Application that connects to both On-Premise SQL Server and Azure DB instances. It is multi-tenanted and I want to use a certificate and password combination on the host pc's to authenticate the user.
That is to say that the user needs to have both the certifiate and a password to access the database.
I intend to use Column Level Encryption with SQL Server/Azure DB to protect the data and Row Level security to isolate the tenants.
Access to row data will be via the users SID from Active Directory.
What is the best way of achieving this? Is this good practice?

First: Welcome to StackOverflow
Your problem clearly needs an Architectural Solution.
You might want to look into a pattern called StrategyPattern.
A StrategyPattern will most likely fit your Approach because you can design your app to having two classes that handle Authentification for your database access. The most simple design would be using an simple Interface (lets call it IDatabaseAuthentificator). Now you have a flag somewhere (for example in the app.config) that decides what kind of database and what kind of Authentification the app should use.
So when you are trying to connect to a Database you will first read the ConnectionString and then this flag.

How to securely connect to a SQL Server database in a single tier Winforms application?

Background
I'm building a single tier application Winforms application using C#. A SQL Server localdb database is attached to the application that runs when the application does. The plan was to use Windows Authentication to verify that the user is part of the MyApplication role/group and can use the application. But, in order to prevent users from accessing the database via other means, I was thinking of using an Application Role so that only the one SQL application user can edit the db tables.
Question
My understanding is that in order to use an Application Role, you need to provide a username and password in the connection string. I can encrypt this information, but obviously it will need decoded before being sent to the database. Is this a concern in a single tier application? What are other alternatives?

To use an application Role, you'll use the sp_setapprole stored procedure where you will provide the name of the application role and the password, rather than sending it in the connection string. When you use application roles, you still connect using an ordinary login, but once you successfully sp_setapprole, your connection loses its user permissions and instead gains the permissions of the application role. Having the decoded password in memory is a concern if you have reason to believe that users may decide to use a debugger to attach to your process to extract the password. Any administrator would also be able to decrypt the encrypted password on disk as well if you choose to use windows machine-level key containers. Using only a single tier for an application that uses a database is a security risk, and you have to decide based on the circumstances surrounding the application whether it is an acceptable risk to gain the reward of skipping a few weeks of design and development.
Source:
https://technet.microsoft.com/en-us/library/ms190998(v=sql.110).aspx
I highly recommend implementing a web api to manage your application's interactions with the database as well as security. This web api could use a windows "service" account to authenticate with the database, and users would authenticate with the api using their individual windows accounts. This has the added benefit of you never having to think about passwords. As far as managing API permissions, that is an issue that is up to you to design and implement as you see fit. The main issue you need to understand and deal with is uniquely identifying AD users. Take a look at this SO post for more info on that: What Active Directory field do I use to uniquely identify a user?
Your service account would have all necessary permissions on the database to do what the application needs to do, but not all api users would necessarily have permission to use all api functions. You would manage a store of uniquely identified AD users that have permission to use the application and what permissions they have. The rest is design and implementation details that are up to you.

Define user with privilege only to execute stored procedures. By this way if someone use SQL Management Studio, s/he cannot browse/edit tables and even cannot see the table names.

Simple client-server solution - how to autenthificate users?

Just got a task to create clien-server system (no more specification yet) but I am sure there will be some kind of user login needed. All I can think of now is just DB based login, if the user is a DB user with e.g. read rights, it will let him continue. Is there any other built-in solution suitable for that?

try to manage users from the application (add a table called users in your DB) don't let users access to DB permissions!!

you can use windows Authentication, or you can authenticate users using NTLM if they your targeted users are located inside the LAN, which is more secure, there is a best practices check the following links
http://support.microsoft.com/kb/301240
http://www.asp.net/mvc/tutorials/older-versions/security/authenticating-users-with-windows-authentication-cs
http://www.codeproject.com/Articles/94612/Windows-Authentication

Best way to implement multiple roles and permissions in c# web app?

I want to implement roles and permissions on a web app we have created and I am looking at using System.Web.Security.SqlRoleProvider to implement this.
My problem is that each client will want to be able to configure who can and cannot perform actions in the system and no two clients will want the same, so creating basic
Admin, User, Manager roles to cover all won't suffice.
What I am proposing to do for each screen is create roles as follows
Screen1Create, Screen1Update, Screen1Delete, Screen1Read
Screen2Create, Screen2Update, Screen2Delete, Screen2Read
and so on.
I would then allow the client to select the roles per user, which would be stored in a cookie when the user logs in.
I could then read the cookie and use user.isinrole to check if each method can be called by the current user.
I realise there is a size constraint with cookies that I need to be aware of. Apart form that, does this sound feasable, is there as better way to do it?
Many thanks for any input.

Really if you want to program this all yourself to the cookie level you're risking opening security holes. The way to do this is with forms authentication combined with role based authorization. Asp.net will give the user a tamperproof cookie.
If you implement roles you can then easily mark methods:
[PrincipalPermission(SecurityAction.Demand, Role="Screen1Create")]
or use code to see if someone is in a particular role.
Lots of info:
http://weblogs.asp.net/scottgu/archive/2006/02/24/ASP.NET-2.0-Membership_2C00_-Roles_2C00_-Forms-Authentication_2C00_-and-Security-Resources-.aspx

Remember that cookies are user-supplied inputs, so if you're going to store the privileges of users in cookies, you must use a keyed hash function (such as HMAC-SHA256) to make sure that users do not grant themselves additional permissions.
Or, if you store all the permissions in your database, it'll be persistent across client computers and you won't need to validate its integrity every time you wish to use it.