I have created a project on Codeplex for it (http://mvcauthorization.codeplex.com/). Note that this version has some major breaking changes from the code I posted in my previous post but has some major improvements, the two biggest being:

• Provider based model so that a database provider is as simple as overriding two methods on AuthorizationProvider
• A global action filter for authorization (requires DependencyResolver)

Check it out and let me know what you think. I will be adding a post to show how to integrate it with the MvcSitemap provider soon.

The end result is you can call Login(userName, password) and when the function call completes you will have an IClaimsPrincipal set that contains all your identity information. Note that this is dependent on some configuration entries, namely:

• CertificateIssuerName – The name of the certificate issuer
• STSThumbprint – The thumbprint of the STS
• STSEndpoint – The remote endpoint of the STS
• STSRelyingPartyEndpoint – The address of the RP endpoint registered with the STS
• DisableRemoteSTSCertificateValidation – Boolean to enable/disable certificate validation (in case you want to disable it in a local/DEV environment)

The process is threefold:

• Create an X509CertificateValidator to validate the certificate
• Create a IssuerNameRegistry to validate the thumbprint
• Utilize some code to actually make the call, decrypt the SAML token, and construct an IClaimsPrincipal

The Certificate Validator:

    public class CustomCertificateValidator : X509CertificateValidator
    {
        public CustomCertificateValidator()
        {
        }

        public override void Validate(System.Security.Cryptography.X509Certificates.X509Certificate2 certificate)
        {
            string allowedIssuerKey = "CertificateIssuerName";

            if (string.IsNullOrEmpty(ConfigurationManager.AppSettings[allowedIssuerKey]))
            {
                throw new ApplicationException(string.Format("Issuer config key {0} does not exist in the configuration", allowedIssuerKey));
            }

            if (!certificate.IssuerName.Name.Equals(ConfigurationManager.AppSettings[allowedIssuerKey]))
            {
                throw new ApplicationException(string.Format("Certificate comes from issuer {0} which is not allowed.", certificate.IssuerName.Name));
            }
        }
    }

The IssuerNameRegistry:

    public class CustomTrustedIssuerNameRegistry : IssuerNameRegistry
    {
        /// <summary>
        /// 
        /// </summary>
        public CustomTrustedIssuerNameRegistry()
        {
        }

        /// <summary>
        /// 
        /// </summary>
        /// <param name="securityToken"></param>
        /// <returns></returns>
        public override string GetIssuerName(SecurityToken securityToken)
        {
            X509SecurityToken x509Token = securityToken as X509SecurityToken;
            if (x509Token != null)
            {
                string thumbprintConfigKey = "STSThumbprint";

                if (string.IsNullOrEmpty(ConfigurationManager.AppSettings[thumbprintConfigKey]))
                {
                    throw new InvalidDataException(string.Format("Thumbprint config key {0} does not exist in the configuration", thumbprintConfigKey));
                }
                
                if (String.Equals(x509Token.Certificate.Thumbprint, ConfigurationManager.AppSettings[thumbprintConfigKey]))
                {
                    return x509Token.Certificate.SubjectName.Name;
                }
            }

            throw new SecurityTokenException("Untrusted issuer.");
        }

        public override string GetWindowsIssuerName()
        {
            return base.GetWindowsIssuerName();
        }
    }

And the main code:

/// <summary>
/// Login method to be used by processes that are not run through the web and can use a membership
/// provider. This login method will attach an IClaimsPrincipal object to the current thread
/// and all new threads that will be created as part of this app domain.
/// </summary>
/// <param name="userName">User name.</param>
/// <param name="password">Password.</param>
/// <returns>Whether the login was successful.</returns>
public static bool Login(string userName, string password)
{
    // Get the previous principal (in case validation fails and we need to restore)
    IPrincipal previousPrincipal = Thread.CurrentPrincipal;
 
    try
    {
        if (System.Threading.Thread.CurrentPrincipal.Identity.IsAuthenticated)
        {
            // Logout if necessary
            Logout();
        }
 
        string endpointKey = "STSEndpoint";
        string rpKey = "STSRelyingPartyEndpoint";
        string disableCertValidationKey = "DisableRemoteSTSCertificateValidation";
 
        // The STS endpoint
        var adfsEndpoint = ConfigurationManager.AppSettings[endpointKey];
 
        // The RP endpoint
        var relyingPartyEndpoint = ConfigurationManager.AppSettings[rpKey];
 
        if (string.IsNullOrEmpty(adfsEndpoint))
        {
            throw new InvalidDataException(string.Format("Endpoint '{0}' is not defined in the configuration and cannot be resolved in Login()", endpointKey));
        }
 
        if (string.IsNullOrEmpty(rpKey))
        {
            throw new InvalidDataException(string.Format("Relying Party '{0}' is not defined in the configuration and cannot be resolved in Login()", relyingPartyEndpoint));
        }
 
        // Append Login with credentials we have here.
        adfsEndpoint = string.Concat(adfsEndpoint, "services/Trust/13/UsernameMixed/");
 
        if (!string.IsNullOrEmpty(disableCertValidationKey))
        {
            string disableRemoteSTSCertificateValidation = ConfigurationManager.AppSettings[disableCertValidationKey];
 
            bool disableSTSCertificateValidation;
 
            if (Boolean.TryParse(disableRemoteSTSCertificateValidation, out disableSTSCertificateValidation))
            {
                if (disableSTSCertificateValidation)
                {
                    // Look up the endpoint for this application
                    ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(
                        delegate
                        {
                            return true;
                        });
                }
            }
        }
 
        var factory = new WSTrustChannelFactory(
                new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential),
                new EndpointAddress(adfsEndpoint));
 
        // Set the credentials
        factory.Credentials.UserName.UserName = userName;
        factory.Credentials.UserName.Password = password;
 
        // Set the issuer registry to validate the thumbprint against
        FederatedAuthentication.ServiceConfiguration.IssuerNameRegistry = new CustomTrustedIssuerNameRegistry();
        FederatedAuthentication.ServiceConfiguration.CertificateValidator = new CustomCertificateValidator();
 
        var handler = FederatedAuthentication.ServiceConfiguration.SecurityTokenHandlers.Where(e => e.TokenType == typeof(Saml2SecurityToken)).FirstOrDefault();
        System.Collections.ObjectModel.Collection<Uri> uris = handler.Configuration.AudienceRestriction.AllowedAudienceUris;
 
        if (uris != null && !uris.Any(u => u.OriginalString == relyingPartyEndpoint))
        {
            uris.Add(new Uri(relyingPartyEndpoint));
        }
 
        var channel = factory.CreateChannel();
 
        var rst = new RequestSecurityToken
        {
            RequestType = RequestTypes.Issue,
            AppliesTo = new EndpointAddress(relyingPartyEndpoint),
            KeyType = KeyTypes.Bearer
        };
 
        RequestSecurityTokenResponse rstr = null;
 
        GenericXmlSecurityToken token = channel.Issue(rst, out rstr) as GenericXmlSecurityToken;
 
        DecryptAndAttachTokenToPrincipal(token);
    }
    catch (Exception ex)
    {
        if (ex is MessageSecurityException)
        {
            // User validation fails.
            // Consume the MessageSecurityException, restore the previous principal, and return false.
            Thread.CurrentPrincipal = previousPrincipal;
            return false;
        }
        else
        {
            // Bubble up any other exceptions
            throw ex;
        }
    }
 
    return true;
}
 
/// <summary>
/// Decrypts the GenericXmlSecurityToken passed in and attaches the claims identity to the
/// thread's principal as a ClaimsPrincipal
/// </summary>
/// <param name="genericXmlSecurityToken"></param>
public static void DecryptAndAttachTokenToPrincipal(GenericXmlSecurityToken genericXmlSecurityToken)
{
    var token = FederatedAuthentication.ServiceConfiguration.SecurityTokenHandlers.ReadToken(new XmlTextReader(new StringReader(genericXmlSecurityToken.TokenXml.OuterXml))); 
    var identity = FederatedAuthentication.ServiceConfiguration.SecurityTokenHandlers.ValidateToken(token).First();
 
    // Get the IClaimsPrincipal and attach it to the current thread
    IClaimsPrincipal claimsPrincipal = ClaimsPrincipal.CreateFromIdentity(identity);
    Thread.CurrentPrincipal = claimsPrincipal;
}

$.ajax(...).done(function() { })

then you have already used them! The above is valid because the jqXHR object that gets returned implements the Promise interface as of jQuery 1.5.

Here’s a high level summary of how Deferreds work:

1. Call $.Deferred with a callback taking the newly created deferred handler as the first parameter. Once the your operation has completed you call resolve() on the deferred handler.
2. The deferred handler should return a promise by calling promise(). Think of a promise as a lightweight version of deferred. In essence it provides an immutable version of the deferred object, meaning it can query the state of the deferred handler, but it can’t modify it (for example, it can’t resolve it).
3. Pass the promise around to any interested consumers who would like to be notified of the event’s completion (success or failure)

Remember, you can call promise.done(…) at any point in your application, even after the deferred handler has been resolved, in which case the callback will be invoked immediately. Another interesting feature is that you can also endow any object with an existing deferred’s promise by calling deferred.promise(objectInstance). Indeed, if you look at the jQuery framework’s code this is how they attach the promise methods to the jqXHR object.

As you might guess this can become pretty powerful as it allows us to express event chains in almost any way imaginable.

As a simple example, imagine you would like to submit two asynchronous requests and perform a fade out animation at the same time. Once all three have finished a fade in animation should be run. Deferreds along with jQuery’s $.when() provide an elegant mechanism to achieve this. Take the code below:

var container = $("#mycontainer");
$.when(
	function () {
		return $.Deferred(function (dfd) {
			container.fadeOut('slow', dfd.resolve);
		}).promise();
	}(),
	$.ajax({
		url: 'Path/To/My/Url/1',
		type: 'POST',
		dataType: 'json'
	}),
	$.ajax({
		url: 'Path/To/My/Url/2',
		type: 'POST',
		dataType: 'json'
	})
).done(function (x, data) {
	container.html('Your request has been processed!');
	container.fadeIn('slow');
});

As you can see we pass three promises to $.when, one for the fade out animation and two for the ajax operations.

• The first parameter is a self executing anonymous function that creates the deferred handler and returns the promise. In $.Deferred’s callback the dfd.resolve function is passed in to fadeOut()’s callback parameter, which means that once the animation completes the deferred will be resolved.
• With regards to the other two parameters we pass to $.when, since the result of $.ajax is a jqXHR object that implements Promise we just pass the value that’s returned as is.

Once all three have completed we replace the content of the container with a friendly message and fade it in. This is obviously a very bare-bones example, and we’ve only scratched the surface with what can be achieved with deferreds. One thing you’ll notice is that I haven’t included any error handling for the $.ajax calls. I’ll leave that as homework.

That’s it! Pretty neat, huh?

It supports several chained cascade modes when a parent list changes to a “no selection” item including:
- Simply clearing the child drop downs
- Clearing the child drop downs, leaving the default selection item intact
- Clearing and disabling the child drop downs, leaving the default selection item intact
- Hiding the child drop downs

How do you use it?

        // Cascade when parent changes
        $('#myParentDropDown').cascading({
                dataUrl: 'http://localhost:31393/Home/GetJsonData/',
                parentDropDownId: 'parentDropDownDOMId',
                noSelectionValue: '0',
                noSelectionText: '[Default Selection]'
            });

The drop downs can be chained any number of ways. As always, the project can be downloaded here. Try it out and let me know what you think, and if there’s any suggestions for enhancements you would like to see in a future release let me know!

The good:
- Installation was a breeze. Simply install the card in your PC, install the software from the Ceton website, plug in your M-Card and you’re good to go! When you run the setup for your TV signal in Media Center it automatically detects your card, runs you through the setup, and gives you all the information you need to activate it. It couldn’t be simpler.
- Four streams!

The bad:
- This is nothing bad about the card, more with my cable company. They don’t have a self installation option, meaning you need to have them come and install the card for you when there’s really no reason why you can’t do it yourself. The $20 installation fee isn’t too bad, but it still seems like a rather pointless fee to pay. Worst part about it is that the technician didn’t even touch my PC. I installed the card and device, and I ran the setup in Media Center myself. All the technician had to do was call the cable co and give them the device ID to activate it. Guess they need to squeeze every penny they can out of you

So what was my first course of action after the installation? Setup a recording schedule for MythBusters and watch Transformers in HD!

If you have any questions about the card that I have not addressed here let me know in the comments section and I will be sure to answer them.

First, imagine this scenario. You have a DAL and DAL providers. Specifically, let’s take a look at a user manager/provider like the ones shown below:

    public class UserManager
    {
        List<User> _users = new List<User>();

        public List<User> GetUsersByNameAndSearch(string name, int userStatusId, string whereClause, string orderBy, int pageIndex, int pageSize)
        {
            // Paginate our fake data source
            return _users.Skip(pageIndex * pageSize).Take(pageSize).ToList();
        }
    }

    public class DalProvider
    {
        private DalProvider()
        {
        }

        private static DalProvider _instance = null;
        public static DalProvider ProviderInstance
        {
            get
            {
                if (_instance == null)
                {
                    _instance = new DalProvider();
                }

                return _instance;
            }
        }

        private UserManager _umInstance = null;
        public UserManager UserManagerInstance
        {
            get
            {
                if (_umInstance == null)
                {
                    _umInstance = new UserManager();
                }

                return _umInstance;
            }
        }
    }

Pretty straight forward. There’s a provider following the singleton pattern, so to get a list of users, we would write something like:

List<User> users 
= LegacyDal.DalProvider.ProviderInstance.UserManagerInstance.GetUsersByNameAndSearch(...);

and from there we can bind that list of users to a grid. But, that’s not very good for RIA services. Paging would become a nightmare (how do we get the skip/take parameters to our legacy DAL for paging?). And custom where clauses? eww! How do we link these two together and have them play nicely? The answer is to provide a framework similar to the one described below, which is composed of two primary things:

1) A LINQ provider which we can use to query our DAL
2) “Hints” on our RIA entities and domain service methods that will tell the LINQ provider how to resolve the appropriate DAL methods.

The best part is the solution will result in you do not having to modify anything in your DAL, it will just link up and work.

So how does it work? First, decorate your RIA entities that are exposed through your domain service with some custom attributes:

    [EntityMap(typeof(LegacyDal.Entities.User))]
    public class RIAUser
    {
        [Key]
        [FieldMap("UserName")]
        public string RiaUserName { get; set; }

        [FieldMap("FirstName")]
        public string RiaFirstName { get; set; }

        [FieldMap("UserStatus")]
        public string RiaUserStatus { get; set; }
    }

Pretty straightforward. Above we are mapping our RIA user to a user entity in our legacy DAL by mapping the entity type and it’s corresponding fields.

Then, we add some configuration:

  <riaToDalLinqSettings
     resolverType="Configuration"
     dalProviderInstance="LegacyDal.DalProvider.ProviderInstance, LegacyDal"
     entityManagerNameFormatString="{0}ManagerInstance"
    />

The above says we will resolve our DAL information using the current configuration by setting resolverType=”Configuration” (we can write our own and export it using MEF if we want, in which case we would set the resolverType=”Custom”). The dalProviderInstance string let’s the framework know the provider instance to use in the DAL. And for the entityManagerNameFormatString it’s just a format string which would evaluate to[EntityName]ManagerInstance, or “UserManagerInstance” if we were looking for a UserManager.

Then, our domain service looks like:

    [EnableClientAccess]
    public class GetDataService : LegacyDalDomainServiceBase
    {
        // Create the query context
        RiaToDalQueryContext<RIAUser> RIAUserQueryContext;

        public GetDataService()
        {
            // Instantiate the context with this domain service
            RIAUserQueryContext = new RiaToDalQueryContext<RIAUser>(this);
        }

        /// <summary>
        /// MethodMap will map our queryable GetUser() ria method 
        /// to the GetUsersByNameAndSearch() method  in our DAL.
        /// It will look for an overload which takes name and userStatusId parameter.
        /// The full method signature in the legacy DAL looks like:
        ///     GetUsersByNameAndSearch(string name, int userStatusId, 
        ///           string whereClause, string orderBy, int pageIndex, int pageSize)
        /// but by convention any parameter name of:
        ///       whereClause, orderBy, pageIndex, pageSize 
        /// will be excluded from the match and
        /// will be passed data based on the LINQ query that is composed.
        /// </summary>
        /// <param name="name"></param>
        /// <returns></returns>
        [MethodMap("GetUsersByNameAndSearch")]
        public IQueryable<RIAUser> GetUser(
            string name,
            int statusId
            )
        {
            // Use some LINQ against our RIA entities. 
            // The Entities property should already filtered by the "name" 
            // and statusId parameters of the current query method,
            // but we can do some additional filtering, and it will be propagated 
            // through to the whereClause in the legacy DAL method.
            var query = from u in RIAUserQueryContext.Entities
                        where (u.RiaFirstName != "Jim" && u.RiaUserStatus == "Active") || u.RiaFirstName == "Ronnie"
                        orderby u.RiaFirstName descending
                        select u;

            // Return the query, let RIA services compose 
            // any additional LINQ sent from the client
            // (such as any paging information)
            return query;
        }
    }

Woah! What’s this doing? I’ll let you figure that out from the comments and the code, but that’s all that needs to be done to integrate RIA with our legacy DAL, the framework will handle the rest. Here’s a screenshot of what the Legacy DAL method receives after this LINQ is executed:

and here’s what the client that executed the query method looked like:

Notice how the where clause from our LINQ expression got passed to the where clause parameter in our DAL method? (it even resolved the correct names by translating RIAFirstName to FirstName). The paging parameters came from the DataPager in the Silverlight client, as did the order by clause. The userName and userStatusId were received from the parameters in the IQueryable GetUser() domain service. All of this was done without any additional code, we just needed to give the framework some “hints” on how to resolve our DAL.

So what’s this running on? Just MEF, Silverlight 4 and WCF RIA Services. This is a very preliminary design, but I’m planning on adding:

• Update support. Call this.Update(entity) in your domain service and based on the mappings it will persist the entity back to the DAL
• Transaction support via TransactionScope
• Deep loading with the [Associate] attribute
• [Ignore] attributes for the query parameters so parameters can be selectively excluded from matching when trying to resolve the appropriate DAL method
• Re-factoring the code and making it more plugable
• Anything I can think of or that’s suggested to me!

Be sure to take a look on Codeplex for the source (and a working example), and if you have any suggestions please let me know in the comments section!

Often times, after you’ve authenticated your users, you’ll want to authorize what they actually have control over based on role. Typically in an ASP.NET MVC project this happens by using an authorize attribute not unlike the one shown below:

[Authorize(Roles = "Programmer, Manager")]
public ActionResult MyTopSecretActionForSuperCoolPeopleOnly()

Unfortunately, the above code directly ties your action and controller code to your user roles. So what happens if a new role is added? Well, in my fake system I just added one, and it’s called the Fonzie role. Anyone who is at Fonzie status is by definition super cool, and needs to have access to our super cool action. So our code above would become:

[Authorize(Roles = "Programmer, Manager, Fonzie")]
public ActionResult MyTopSecretActionForSuperCoolPeopleOnly()

But, because our solution is code based we need to wait for a re-deployment and only then will the Fonzies get access to to our action. Not good! Also, what do we do about any action links to that action? We don’t want them just showing up for any old user. We’d better address that as well.

The solution to this problem is to create new configuration sections in web.config, which will allow us to specify authorization roles for our actions and controllers in a declarative way. That way, we only need to update the configuration, and the roles are automatically mapped to the actions and controllers without need for re-deployment. Below is what the code using this functionality should ultimately look like.

Define a configuration for controller/action roles:

  <authorizationConfiguration>
    <controllerAuthorizationMappings>
      <add controller="Home" role="GeneralAccess">        
        <!-- Define allowed roles for actions under the Home Controller -->
        <actionAuthorizationMappings>
          <add action="MyTopSecretActionForSuperCoolPeopleOnly" roles="Developer,Manager,Fonzie" />
        </actionAuthorizationMappings>
      </add>
    </controllerAuthorizationMappings>
  </authorizationConfiguration>

The configuration above says we should allow any user with GeneralAccess to the “Home” controller, but our top secret action should only be accessible to users with a Developer, Manager, or Fonzie role. Then to use it, we would just need to decorate our action with a new attribute called ActionAuthorize, which is derived from AuthorizeAttribute, and needs no parameters:

[ActionAuthorize]
public ActionResult MyTopSecretActionForSuperCoolPeopleOnly()

And the new attribute would be smart enough to look-up the roles for this action and allow/disallow access based on the configuration. (Note that in addition to [ActionAuthorize], we also have an attribute called [ControllerAuthorize] which does the same thing for controllers).

When we link to this action, we would need to have a custom html helper that only renders the action link when the user is in role for that action. The usage would look like:

<%= Html.SecuredActionLink("Secure Link.", "MyTopSecretActionForSuperCoolPeopleOnly") %>

To accomplish the above we will need to start off with five classes for our configuration section:

AuthorizationConfiguration
This class defines the root or our configuration section and contains a static accessor property, as well as a ControllerAuthorizationConfigurationCollection.

    public class AuthorizationConfiguration : ConfigurationSection
    {
        private static AuthorizationConfiguration _authorizationConfiguration
            = ConfigurationManager.GetSection("authorizationConfiguration") as AuthorizationConfiguration;

        public static AuthorizationConfiguration Section
        {
            get
            {
                return _authorizationConfiguration;
            }
        }

        [ConfigurationProperty("controllerAuthorizationMappings")]
        public ControllerAuthorizationConfigurationCollection ControllerAuthorizationMappings
        {
            get
            {
                return this["controllerAuthorizationMappings"] as ControllerAuthorizationConfigurationCollection;
            }
        }
    }

ControllerAuthorizationConfigurationCollection
This class will encapsulate our collection of Controller configurations.

   public class ControllerAuthorizationConfigurationCollection : ConfigurationElementCollection, 

IEnumerable<ControllerAuthorizationConfigurationElement>
    {
        /// <summary>
        /// 
        /// </summary>
        /// <param name="index"></param>
        /// <returns></returns>
        public ControllerAuthorizationConfigurationElement this[int index]
        {
            get
            {
                return base.BaseGet(index) as ControllerAuthorizationConfigurationElement;
            }
            set
            {
                if (base.BaseGet(index) != null)
                {
                    base.BaseRemoveAt(index);
                }
                this.BaseAdd(index, value);
            }
        }

        /// <summary>
        /// 
        /// </summary>
        public IEnumerable<ControllerAuthorizationConfigurationElement> Elements
        {
            get
            {
                for (int i = 0; i < base.Count; ++i)
                {
                    yield return this[i];
                }
            }
        }

        /// <summary>
        /// 
        /// </summary>
        /// <returns></returns>
        IEnumerator IEnumerable.GetEnumerator()
        {
            return GetEnumerator();
        }

        /// <summary>
        /// 
        /// </summary>
        /// <returns></returns>
        public new IEnumerator<ControllerAuthorizationConfigurationElement> GetEnumerator()
        {
            for (int i = 0; i < base.Count; ++i)
            {
                yield return this[i];
            }
        }

        /// <summary>
        /// 
        /// </summary>
        /// <returns></returns>
        protected override ConfigurationElement CreateNewElement()
        {
            return new ControllerAuthorizationConfigurationElement();
        }

        /// <summary>
        /// 
        /// </summary>
        /// <param name="element"></param>
        /// <returns></returns>
        protected override object GetElementKey(ConfigurationElement element)
        {
            return ((ControllerAuthorizationConfigurationElement)element).Controller;
        } 
    }

ControllerAuthorizationConfigurationElement

This class will define the base configuration element for a controller. It has an optional property called “Roles” which we can use to lock down a controller by a certain set of roles. It also has an actionAuthorizationConfigurationCollection to maintain a list of actions.

    public class ControllerAuthorizationConfigurationElement : ConfigurationElement
    {
        [ConfigurationProperty("controller", IsRequired = true)]
        public string Controller
        {
            get
            {
                return (string)this["controller"];
            }
            set
            {
                this["controller"] = value;
            }
        }

        [ConfigurationProperty("roles", IsRequired = false)]
        public string Roles
        {
            get
            {
                return (string)this["roles"];
            }
            set
            {
                this["roles"] = value;
            }
        }

        [ConfigurationProperty("actionAuthorizationMappings")]
        public ActionAuthorizationConfigurationCollection ActionAuthorizationMappings
        {
            get
            {
                return this["actionAuthorizationMappings"] as ActionAuthorizationConfigurationCollection;
            }
        }
    }

ActionAuthorizationConfigurationCollection
This class will encapsulate our collection of Controller configurations under the current controller.

   public class ActionAuthorizationConfigurationCollection : ConfigurationElementCollection, 

IEnumerable<ActionAuthorizationConfigurationElement>
    {
        /// <summary>
        /// 
        /// </summary>
        /// <param name="index"></param>
        /// <returns></returns>
        public ActionAuthorizationConfigurationElement this[int index]
        {
            get
            {
                return base.BaseGet(index) as ActionAuthorizationConfigurationElement;
            }
            set
            {
                if (base.BaseGet(index) != null)
                {
                    base.BaseRemoveAt(index);
                }
                this.BaseAdd(index, value);
            }
        }

        /// <summary>
        /// 
        /// </summary>
        public IEnumerable<ActionAuthorizationConfigurationElement> Elements
        {
            get
            {
                for (int i = 0; i < base.Count; ++i)
                {
                    yield return this[i];
                }
            }
        }

        /// <summary>
        /// 
        /// </summary>
        /// <returns></returns>
        IEnumerator IEnumerable.GetEnumerator()
        {
            return GetEnumerator();
        }

        /// <summary>
        /// 
        /// </summary>
        /// <returns></returns>
        public new IEnumerator<ActionAuthorizationConfigurationElement> GetEnumerator()
        {
            for (int i = 0; i < base.Count; ++i)
            {
                yield return this[i];
            }
        }

        /// <summary>
        /// 
        /// </summary>
        /// <returns></returns>
        protected override ConfigurationElement CreateNewElement()
        {
            return new ActionAuthorizationConfigurationElement();
        }

        /// <summary>
        /// 
        /// </summary>
        /// <param name="element"></param>
        /// <returns></returns>
        protected override object GetElementKey(ConfigurationElement element)
        {
            return ((ActionAuthorizationConfigurationElement)element).Action;
        } 
    }

ActionAuthorizationConfigurationElement
This class will encapsulate a particular action under a controller. It has a required “Roles” parameter.

    public class ActionAuthorizationConfigurationElement : ConfigurationElement
    {
        [ConfigurationProperty("action", IsRequired = true)]
        public string Action
        {
            get
            {
                return (string)this["action"];
            }
            set
            {
                this["action"] = value;
            }
        }

        [ConfigurationProperty("roles", IsRequired = true)]
        public string Roles
        {
            get
            {
                return (string)this["roles"];
            }
            set
            {
                this["roles"] = value;
            }
        }
    }

After we have defined our configuration elements and registered the section in our web.config, we can start using it. We define two attribute classes which will perform the authentication look-up for our controllers and actions:

ActionAuthorizeAttribute targets an action method:

    /// <summary>
    /// Authorization attribute for an MVC action method
    /// </summary>
    [AttributeUsage(AttributeTargets.Method)]
    public class ActionAuthorizeAttribute : AuthorizeAttribute
    {
        private string[] _rolesArray;
        private string _authorizationGroupName;

        /// <summary>
        /// 
        /// </summary>
        public string AccessDeniedController { get; set; }

        /// <summary>
        /// 
        /// </summary>
        public string AccessDeniedAction { get; set; }

        /// <summary>
        /// 
        /// </summary>
        public ActionAuthorizeAttribute()
        {
            AccessDeniedController = ConfigurationManager.AppSettings["DefaultAccessDeniedController"] ?? 

"AccessDenied";
            AccessDeniedAction = ConfigurationManager.AppSettings["DefaultAccessDeniedAction"] ?? "Index";
            _authorizationGroupName = string.Empty;
        }

        /// <summary>
        /// 
        /// </summary>
        public string[] RolesArray
        {
            get
            {
                return _rolesArray;
            }
            set
            {
                _rolesArray = value;
                this.Roles = string.Join(",", _rolesArray);
            }
        }

        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            string controllerName = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName;

            // Get any controller specific role mappings
            var controllerRoleMappings = AuthorizationConfiguration.Section.ControllerAuthorizationMappings.Where(e 

=> e.Controller == controllerName).FirstOrDefault();

            if (controllerRoleMappings != null)
            {
                var actionRoleMappings = controllerRoleMappings.ActionAuthorizationMappings.Where(e => e.Action == 

filterContext.ActionDescriptor.ActionName).FirstOrDefault();

                if (actionRoleMappings != null && !string.IsNullOrEmpty(actionRoleMappings.Roles))
                {
                    this.RolesArray = actionRoleMappings.Roles.Split(',');
                }
            }

            //
            base.OnAuthorization(filterContext);
        }

        protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
        {
            filterContext.Result = new RedirectToRouteResult(new System.Web.Routing.RouteValueDictionary(new { 

Controller = AccessDeniedController, Action = AccessDeniedAction, Roles = Roles }));
        }
    }

ControllerAuthorizeAttribute targets a controller class:

    /// <summary>
    /// Authorization attribute for an MVC controller
    /// </summary>
    [AttributeUsage(AttributeTargets.Class)]
    public class ControllerAuthorizeAttribute : AuthorizeAttribute
    {
        private string[] _rolesArray;
        private string _authorizationGroupName;

        /// <summary>
        /// 
        /// </summary>
        public string AccessDeniedController { get; set; }

        /// <summary>
        /// 
        /// </summary>
        public string AccessDeniedAction { get; set; }

        /// <summary>
        /// 
        /// </summary>
        public ControllerAuthorizeAttribute()
        {
            AccessDeniedController = ConfigurationManager.AppSettings["DefaultAccessDeniedController"] ?? 

"AccessDenied";
            AccessDeniedAction = ConfigurationManager.AppSettings["DefaultAccessDeniedAction"] ?? "Index";
            _authorizationGroupName = string.Empty;
        }

        /// <summary>
        /// 
        /// </summary>
        public string[] RolesArray
        {
            get
            {
                return _rolesArray;
            }
            set
            {
                _rolesArray = value;
                this.Roles = string.Join(",", _rolesArray);
            }
        }

        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            string controllerName = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName;

            // Get any controller specific role mappings
            var controllerRoleMappings = AuthorizationConfiguration.Section.ControllerAuthorizationMappings.Where(e 

=> e.Controller == controllerName).FirstOrDefault();

            if (controllerRoleMappings != null && !string.IsNullOrEmpty(controllerRoleMappings.Roles))
            {
                this.RolesArray = controllerRoleMappings.Roles.Split(',');
            }

            //
            base.OnAuthorization(filterContext);
        }

        protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
        {
            filterContext.Result = new RedirectToRouteResult(new System.Web.Routing.RouteValueDictionary(new { 

Controller = AccessDeniedController, Action = AccessDeniedAction, Roles = Roles }));
        }
    }

Then for dynamic action link rendering based on role, the following Html helper would be as follows:

        /// <summary>
        /// Renders the action link, provided the user has access to the action method being linked to
        /// </summary>
        /// <param name="helper"></param>
        /// <param name="linkText"></param>
        /// <param name="actionName"></param>
        /// <returns></returns>
        public static MvcHtmlString SecuredActionLink(this HtmlHelper helper, string linkText, string actionName)
        {
            MvcHtmlString html = MvcHtmlString.Empty;
            string[] roles = null;

            RouteData routeData = helper.ViewContext.RouteData;
            string controllerName = routeData.GetRequiredString("controller");

            // Get any controller specific role mappings
            var controllerRoleMappings = AuthorizationConfiguration.Section.ControllerAuthorizationMappings.Where(e 

=> e.Controller == controllerName).FirstOrDefault();
            ActionAuthorizationConfigurationElement actionRoleMappings = null;

            if (controllerRoleMappings != null)
            {
                actionRoleMappings = controllerRoleMappings.ActionAuthorizationMappings.Where(e => e.Action == 

actionName).FirstOrDefault();

                if (actionRoleMappings != null && !string.IsNullOrEmpty(actionRoleMappings.Roles))
                {
                    roles = actionRoleMappings.Roles.Split(',');
                }
            }

            if (roles != null)
            {
                foreach (string role in roles)
                {
                    if (ApplicationUser.Current.Roles.Contains(role))
                    {
                        html = System.Web.Mvc.Html.LinkExtensions.ActionLink(helper, linkText, actionName);
                        break;
                    }
                }
            }
            else if (actionRoleMappings == null)
            {
                // If there's no roles associated to that action then render the link
                html = System.Web.Mvc.Html.LinkExtensions.ActionLink(helper, linkText, actionName);
            }

            return html;
        }
    }

The helper above will figure out if the user has access to the action, display accordingly, and viola! Users will never see a link to an action for which they do not have access, and if they do somehow get to an action that is restricted based on their role they will get redirected to an access denied page of your choosing.

This is just a basic sample, but there’s lots that can be done in addition to this. Be sure to download the source here to see it in action (VS 2010, ASP.NET MVC 2, and WIF required). In particular play around with the role definitions at the bottom of the web.config to see the actions dynamically authorize as the roles in the config change. The authentication is done via the default STS server project that gets created when you create a federated security application, so you will need to install the WIF RTW and SDK in order to successfully run the project the way it is.

First, downoad the required assemblies. Note that there are assemblies for WinForms, WPF, ASP.NET MVC (not just Silverlight) included!

Then, you will need to setup your account at http://www.facebook.com/developers/. Click on “Setup New Application” and enter a new application name as shown in the screenshot below:

Then fill out the fields shown below on the “Basic Info” tab. Note the developers area. Add any devs who will be working on the app there:

From there fill out the connect information. In development this will be the local http://localhost:[port] that that you are developing on. In production it will be yourdomain.com:

Then click on the advanced tab and enable Sandbox mode, as we will be using this account for development purposes:

Cool! Now that we have our account setup we need to create a “Silverlight Navigation Application” in Visual Studio. To make everything work, we need to add a javascript file to the same directory as the HTML page that is hosting our Silverlight app. This will allow us to facilitate the cross domain communication between our app and Facebook (note the var silverLightPluginId must match the DOM id of the Silverlight plugin on the page!!!):

fblogin.js

//must match the Silverlight plugin's DOM ID
var silverlightPluginId = 'Silverlight1';

function facebook_init(appid) {
    FB.init(appid, "/xd_receiver.htm");
}

function isUserConnected() {
    FB.ensureInit(function () {
        FB.Connect.get_status().waitUntilReady(function (status) {
            var plugin = document.getElementById(silverlightPluginId);
        });
    });
}

function facebook_login() {
    FB.ensureInit(function () {
        FB.Connect.requireSession(facebook_getSession, true);
    });
}

function facebook_logout() {
    FB.Connect.logout(facebook_onlogout);
}

function facebook_getSession() {

    FB.Facebook.get_sessionState().waitUntilReady(function () {
        var session = FB.Facebook.apiClient.get_session();
        var plugin = document.getElementById(silverlightPluginId);
        plugin.Content.FacebookLoginControl.LoggedIn(session.session_key, session.secret, session.expires, session.uid);
    });
}

function facebook_onlogout() {
    var plugin = document.getElementById(silverlightPluginId);
    plugin.Content.FacebookLoginControl.LoggedOut();
}

function facebook_onpermission(accepted) {
    var plugin = document.getElementById(silverlightPluginId);
    plugin.Content.FacebookLoginControl.PermissionCallback(accepted);
}

function facebook_prompt_permission(permission) {
    FB.ensureInit(function () {
        FB.Connect.showPermissionDialog(permission, facebook_onpermission);
    });
}

Include the script in the page hosting the Silverlight app:

<script src="http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php" type="text/javascript"></script>
<script type="text/javascript" src="fblogin.js"></script>

Now, add the file xd_receiver.htm to the same directory as the javascript file. This will receive the response from Facebook and route it appropriately:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" 
     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
  <body>
    <script src=http://static.ak.connect.facebook.com/js/api_lib/v0.4/XdCommReceiver.js
                    type="text/javascript">
    </script>
  </body>
</html>

Whew! Now that all that’s done we can tackle the Silverlight part. Add a reference the assembly Facebook.Silverlight.dll to your Silverlight project. Note that if you are using Visual Studio 2010 you might get a build error similar to the following after you add the reference:

—> System.NotSupportedException: An attempt was made to load an assembly from a network location which would have caused the assembly to be sandboxed in previous versions of the .NET Framework. This release of the .NET Framework does not enable CAS policy by default, so this load may be dangerous. If this load is not intended to sandbox the assembly, please enable the loadFromRemoteSources switch. See http://go.microsoft.com/fwlink/?LinkId=155569 for more information.

This is because the CAS policies have changed in VS2010. No worries though, just locate the assembly in the file system and Unblock it by clicking on the button in the screenshot below:

In your Silverlight application you then just need to initialize the Facebook API object and invoke the Login() method:

        private Api _facebookAPI;
        private readonly BrowserSession _browserSession;
        private const string ApplicationKey = "[Put your application key here, yes I know it's not the best place to initialize it!]";

        public Home()
        {
            InitializeComponent();

            _browserSession = new BrowserSession(ApplicationKey);
            _browserSession.LoginCompleted += browserSession_LoginCompleted;
            _browserSession.GetStatusCompleted += new EventHandler<GetStatusCompletedEventArgs>(_browserSession_GetStatusCompleted);
            _browserSession.Login();
        }

This will generate the browser popup to have the user login to their Facebook account. Once the user is logged in the _browserSession_GetStatusCompleted method gets invoked:

        private void browserSession_LoginCompleted(object sender, EventArgs e)
        {
            _facebookAPI = new Api(_browserSession);

            //set the photo and friends list item sources
            Photos.ItemsSource = myImages;
            FriendsList.ItemsSource = myFriends;

            //get my friends
            _facebookAPI.Friends.GetUserObjectsAsync(
                (friends, state, ex) =>
                {
                    if (ex == null)
                    {
                        Dispatcher.BeginInvoke(
                            () =>
                            {
                                AddFriends(friends);
                            });
                    }
                }, null);

            Facebook.Session.BrowserSession session = sender as Facebook.Session.BrowserSession;

            _facebookAPI.Photos.GetAsync(session.UserId.ToString(), null, null,
                new Photos.GetCallback(
                    (photos, obj, ex) =>
                    {
                        Dispatcher.BeginInvoke(
                            () =>
                            {
                                AddPhotos(photos);
                            });
                    }), null);
        }

In here we’re doing a couple things. First we’re invoking the FB-API and getting the user’s friends and a listing of all photos they have been tagged in. Once we have those we add them to the myImages and myFriends observable collections, which are bound to the UI. The AddFriends() and AddPhotos() implementations are listed below:

        //add friends to the observable collection
        private void AddFriends(IList<Facebook.Schema.user> friends)
        {
            foreach (Facebook.Schema.user friend in friends)
            {
                myFriends.Add(new Friend()
                {
                    Name = friend.first_name,
                    Photo = new BitmapImage(new Uri(friend.pic_small)),
                    UserId = friend.uid.GetValueOrDefault(),
                    Activities = friend.activities,
                    Affiliations = friend.affiliations != null && friend.affiliations.affiliation != null && friend.affiliations.affiliation.Count > 0 ? friend.affiliations.affiliation.Select(a => a.name).Aggregate((i, j) => string.Concat(i, ", ", j)) : string.Empty,
                    Books = friend.books,
                    EducationHistory = friend.education_history != null && friend.education_history.education_info != null ? GetEducation(friend.education_history) : string.Empty,
                    Interests = friend.interests,
                    Movies = friend.movies,
                    Music = friend.music,
                    Quotes = friend.quotes,
                    Sex = friend.sex,
                    TV = friend.tv,
                    WorkHistory = friend.work_history != null && friend.work_history.work_info != null && friend.work_history.work_info.Count > 0 ? friend.work_history.work_info.Select(e => e.company_name).Aggregate((i, j) => string.Concat(i, ", ", j)) : string.Empty
                });
            }
        }

        private void AddPhotos(IList<Facebook.Schema.photo> photos)
        {
            foreach (Facebook.Schema.photo photo in photos)
            {
                myImages.Add(
                        new Photo() { 
                            Small = new BitmapImage(new Uri(photo.src_small)),
                            Normal = new BitmapImage(new Uri(photo.src)),
                            Large = new BitmapImage(new Uri(photo.src_big))
                        }
                    );
            }
        }


        /// <summary>
        /// gets a string representing all education history
        /// </summary>
        /// <param name="educationHistory"></param>
        /// <returns></returns>
        private string GetEducation(Facebook.Schema.userEducation_history educationHistory)
        {
            return educationHistory.education_info.Select(
                    (e) =>
                    {
                        return string.Format(" {0} {1} {2} {3}", 
                            //degree info
                           !string.IsNullOrEmpty(e.degree) ? "Degree: " + e.degree : string.Empty, 

                            //concentration info
                            e.concentrations != null && e.concentrations.concentration != null && e.concentrations.concentration.Count > 0
                            ? 
                                "Concentrations: " + e.concentrations.concentration.Aggregate(
                                (i, j) => {
                                    return string.Concat(i, ", ", j);
                                }) : string.Empty, 
                            
                            //college name
                            !string.IsNullOrEmpty(e.name) ? "College Name: " + e.name : string.Empty, 
                            
                            //college year
                            e.year > 0 ? "Year Graduated: " + e.year : string.Empty);
                    }).Aggregate((i, j) =>
                    {
                        return string.Concat(i, j);
                    });
        }

That’s the core code! Now our UI just needs to bind to the collections and we have all the data we need. Check it out!

Working Demo (If your firewall blocks requests to/from Facebook this will just hang and will not load!!)

Download the project to get the fully working solution (in VS2010 and Silverlight 4)

First, to house the video we create a rectangle in XAML. Note the render transform. This will flip the image about it’s Y-Axis so it appears like a mirror, which is more intuitive when viewing the video on screen.

        <Rectangle Height="254" HorizontalAlignment="Left" Margin="31,47,0,0" Name="VideoPane" Stroke="Black" StrokeThickness="1" VerticalAlignment="Top" Width="511" RenderTransformOrigin="0.5,0.5">
            <Rectangle.RenderTransform>
                <TransformGroup>
                    <ScaleTransform ScaleX="-1"/>
                    <SkewTransform AngleX="0" AngleY="0"/>
                    <RotateTransform Angle="0"/>
                    <TranslateTransform/>
                </TransformGroup>
            </Rectangle.RenderTransform>
        </Rectangle>

Next we create two listboxes to show a list of devices suitable for audio and video capture. The user needs to select an audio and video device before starting capture.

        <dataInput:Label Height="18" HorizontalAlignment="Left" Margin="109,426,0,0" Content="Video Devices" Name="label1" VerticalAlignment="Top" Width="83" />
        <ListBox Height="48" Margin="31,443,0,0" Name="VideoCaptureDevices" VerticalAlignment="Top" HorizontalAlignment="Left" Width="256">
            <ListBox.ItemTemplate>
                <DataTemplate>
                    <TextBlock Text="{Binding FriendlyName}" />
                </DataTemplate>
            </ListBox.ItemTemplate>
        </ListBox>
        <dataInput:Label Height="18" HorizontalAlignment="Left" Margin="367,426,0,0" Content="Audio Devices" Name="label2" VerticalAlignment="Top" Width="83" />
        <ListBox Height="48" HorizontalAlignment="Left" Margin="293,443,0,0" Name="AudioCaptureDevices" VerticalAlignment="Top" Width="249">
            <ListBox.ItemTemplate>
                <DataTemplate>
                    <TextBlock Text="{Binding FriendlyName}" />
                </DataTemplate>
            </ListBox.ItemTemplate>
        </ListBox> 

The following will display a list of images captured when the user takes a CamShot:

        <ScrollViewer Margin="34,313,33,102" Width="505" VerticalScrollBarVisibility="Hidden" HorizontalScrollBarVisibility="Auto">
            <ItemsControl x:Name="PhotoShots" Height="106">
                <ItemsControl.ItemTemplate>
                    <DataTemplate>
                        <Image Source="{Binding}" Margin="5" Stretch="UniformToFill" Height="70" />
                    </DataTemplate>
                </ItemsControl.ItemTemplate>
                <ItemsControl.ItemsPanel>
                    <ItemsPanelTemplate>
                        <StackPanel Orientation="Horizontal" VerticalAlignment="Center" HorizontalAlignment="Center" />
                    </ItemsPanelTemplate>
                </ItemsControl.ItemsPanel>
            </ItemsControl>
        </ScrollViewer>

In our code behind we create a capture source and an ObservableCollection to hold our images captured from the webcam. We then get the list of devices and set the item source properties when the page is loaded.

        CaptureSource captureSource = new CaptureSource();
        ObservableCollection<WriteableBitmap> photoShots = new ObservableCollection<WriteableBitmap>();

        public MainPage()
        {
            InitializeComponent();
            this.Loaded += new RoutedEventHandler(MainPage_Loaded);
        }

        void MainPage_Loaded(object sender, RoutedEventArgs e)
        {
            VideoCaptureDevices.ItemsSource = CaptureDeviceConfiguration.GetAvailableVideoCaptureDevices();
            AudioCaptureDevices.ItemsSource = CaptureDeviceConfiguration.GetAvailableAudioCaptureDevices();
            PhotoShots.ItemsSource = photoShots;
        }

When we are told to start the capture, make sure the user selected the audio and video capture devices, request access to the device, and if the user allowed us access then set the sink capture sources, create the brush, start capture, and give the rectangle a drop shadow effect.

        private void StartWebCam_Click(object sender, RoutedEventArgs e)
        {
            if (VideoCaptureDevices.SelectedItem != null && AudioCaptureDevices.SelectedItem != null)
            {
                //stop the source if it's started
                if (captureSource.State == CaptureState.Started)
                {
                    captureSource.Stop();
                }

                //VideoCaptureDevice device = CaptureDeviceConfiguration.GetDefaultVideoCaptureDevice();
                VideoCaptureDevice videoDevice = VideoCaptureDevices.SelectedItem as VideoCaptureDevice;

                //AudioCaptureDevice device = CaptureDeviceConfiguration.GetDefaultAudioCaptureDevice();
                AudioCaptureDevice audioDevice = AudioCaptureDevices.SelectedItem as AudioCaptureDevice;

                //check to see if we have already been allowed access or request if we have not
                if (CaptureDeviceConfiguration.AllowedDeviceAccess || CaptureDeviceConfiguration.RequestDeviceAccess())
                {
                    captureSource.VideoCaptureDevice = videoDevice;
                    captureSource.AudioCaptureDevice = audioDevice;

                    //set the video sink's capture source
                    videoSink.CaptureSource = captureSource;
                    audioSink.CaptureSource = captureSource;

                    //create a brush and set the source to the capture source
                    VideoBrush brush = new VideoBrush();
                    brush.SetSource(captureSource);
                    brush.Stretch = Stretch.UniformToFill;

                    //start the capture
                    captureSource.Start();

                    //paint the rectangle with the video
                    VideoPane.Fill = brush;

                    //set the effect
                    VideoPane.Effect = new DropShadowEffect() { ShadowDepth = 7 };
                }
            }
            else
            {
                MessageBox.Show("Please select an audio and a video capture device to start the session");
            }
        }

The following will take a screenshot and add it to the observable collection of WriteableBitmaps:

        private void TakeCamShot_Click(object sender, RoutedEventArgs e)
        {
            if (captureSource != null)
            {
                captureSource.AsyncCaptureImage(
                    (img) =>
                    {
                        photoShots.Add(img);
                    });
            }
        }

Below are the AudioSink and VideoSink implementations. They can be extended to save the streams to whatever destination is needed:

    /// <summary>
    /// 
    /// </summary>
    public class MSVideoSink : VideoSink
    {
        /// <summary>
        /// Video
        /// </summary>
        public MemoryStream VideoStream
        {
            get;
            private set;
        }


        /// <summary>
        /// Format
        /// </summary>
        public VideoFormat Format
        {
            get;
            set;
        }

        /// <summary>
        /// Capture started
        /// </summary>
        protected override void OnCaptureStarted()
        {
            VideoStream = new MemoryStream();
        }


        /// <summary>
        /// Capture stops
        /// </summary>
        protected override void OnCaptureStopped()
        {
            //post-process video data
        }


        /// <summary>
        /// Format changing
        /// </summary>
        /// <param name="videoFormat"></param>
        protected override void OnFormatChange(VideoFormat videoFormat)
        {
            //do stuff on format change, i.e. close off stream, etc
            Format = videoFormat;
        }

        /// <summary>
        /// Write the sample data to the stream
        /// </summary>
        /// <param name="sampleTime"></param>
        /// <param name="frameDuration"></param>
        /// <param name="sampleData"></param>
        protected override void OnSample(long sampleTime, long frameDuration, byte[] sampleData)
        {
            //do something here...i.e. stream it to a file, etc
            //VideoStream.Write(sampleData, 0, sampleData.Length);
        }
    }


    /// <summary>
    /// 
    /// </summary>
    public class MSAudioSink : AudioSink
    {
        /// <summary>
        /// Capture starts
        /// </summary>
        protected override void OnCaptureStarted()
        {
            WaveformDataStream = new MemoryStream();
        }

        /// <summary>
        /// Post-process audio data
        /// </summary>
        protected override void OnCaptureStopped()
        {
        }

        /// <summary>
        /// Audio format
        /// </summary>
        public AudioFormat Format
        {
            get;
            set;
        }

        /// <summary>
        /// Memory stream
        /// </summary>
        public MemoryStream WaveformDataStream
        {
            get;
            set;
        }

        /// <summary>
        /// Format is changing
        /// </summary>
        /// <param name="format"></param>
        protected override void OnFormatChange(AudioFormat format)
        {
            //do stuff on format change, i.e. close off stream, etc
            Format = format;
        }

        /// <summary>
        /// Save each sample
        /// </summary>
        /// <param name="sampleTime"></param>
        /// <param name="sampleDuration"></param>
        /// <param name="sampleData"></param>
        protected override void OnSamples(long sampleTime, long sampleDuration, byte[] sample)
        {
            //do something here...i.e. stream it to a file, etc
           // WaveformDataStream.Write(sample, 0, sample.Length);
        }
    }  

Below is a screenshot of the result:

Download the source code (VS2010):
SilverlightWebcamApp.zip

Edge detection (some cool effects):
http://kodierer.blogspot.com/2009/11/edgecam-silverlight-4-webcam-edge.html
http://kodierer.blogspot.com/2009/07/livin-on-edge-silverlight-parametric_4324.html

Saving streams to AVI files:
http://mtaulty.com/CommunityServer/blogs/mike_taultys_blog/archive/2009/12/10/silverlight-4-more-on-capturing-video-from-webcams.aspx

For those of you looking to build an HTPC for yourself I posted my specs below. The final price tag came to around $1,100, but it was well worth it considering I use it every day. Note that I bought these parts almost a year ago, so the price for the some of the components has most likely went down some. The PC is currently used by 2 extenders, and I also use this machine as a PlayOn server so the PS3 in my house can get on demand content as well.

• ZALMAN CNPS9500 AT 2 Ball CPU Cooling Fan/Heatsink – Retail
• ZALMAN ZM – NBF 47 Aluminum Heatsinks only – Retail
• CORSAIR 4GB (2 x 2GB) 240-Pin DDR2 SDRAM DDR2 800 (PC2 6400) Dual Channel Kit Desktop Memory Model TWIN2X4096-6400C5 – Retail
• LG Black LG Blu-ray/HD DVD-ROM & 16X DVD±R DVD Burner SATA Model GGC-H20L – OEM
• [2x] – Western Digital Caviar Black WD1001FALS 1TB 7200 RPM SATA 3.0Gb/s 3.5″ Internal Hard Drives -Bare Drive
• Hauppauge WinTV-HVR-2250 Dual TV Tuner / Encoder 1229 PCI-Express x1 Interface – Retail
• RAIDMAX HYBRID 2 RX-630SS 630W ATX12V V2.2/ EPS12V SLI Ready CrossFire Ready Modular Modular LED Power Supply – Retail
• GIGABYTE GA-E7AUM-DS2H LGA 775 NVIDIA GeForce 9400 HDMI Micro ATX Intel Motherboard – Retail
• Intel Core 2 Quad Q6600 Kentsfield 2.4GHz LGA 775 Quad-Core Processor Model BX80562Q6600 – Retail
• Zalman Tech HD160PLUS Zalman HTC HD160 Plus Home Theatre PC Enclosure (Black)
• Windows 7
• Boxee – An awesome (free) application that allows you to stream sources (some in HighDef!) like NetFlix, YouTube, Pandora, last.fm, ShoutCast, ComedyCentral, AppleTrailers, Joost, Flickr, MTV and Hulu just to name a few. With 10 minutes worth of work it’s able to be launched completely from MediaCenter.
• ArcSoft TotalMedia Theatre 3 Platinum – For Blu-Ray playback

One thing I would like to do as well is setup X10 Home Automation software for the media center. I’ll post on it later if I get it setup.

Media Center Machine	Remote	Media Center Available Space
FM Radio	Fringe	NFL Guide
NFL Guide 2	Iron Man on Blu-Ray	Boxee Link in Media Center
Boxee	Boxee Applications	Pandora in Boxee
Pandora in Boxee 2	Pandora Boxee Visualization	Pandora Boxee Visualization 2