4

I'm wondering if this is at all possible with all the security involved with the PasswordBox control:

I have a XAML form (C#/WPF) where users will configure a database access. In that form i'm using a PasswordBox to get the SQL Server user password.

Since this data is saved to disk for future use (in a pasword protected SQL Server CE database file), while on first run there is no password set, if the user comes back and needs to edit the SQL connection for some reason, then there could be a password kept from the previous configuration (unless he used Windows Authentication rather than SQL User Authentication)

So I want to show an empty PasswordBox on the first run but if there's a password set already, when the user returns I want to show X number of '*' (to give indication that there is a password in place.

Since PasswordBox.Password isn't bindable, I can only choose to always show it empty or always show a fixed number of '*' (by setting a default Password that doesn't actually represent the real password).

Is there any alternative (besides something like the PasswordBox Helper that injects binding of course - i'd rather not go that path as there might be a reason i haven't considered for MS to choose not to make it bindable even to a SecureString)?

6
  • @faflo10: yes, i am separating View, ViewModel and Model, but of course can break those rules if absolutly required. The password read from the SQLce file (if there is one) is kept in my Model while the PasswordBox sits in the View
    – 537mfb
    Aug 19, 2015 at 7:40
  • 2
    You can read from the file and Write a code behind stating PasswordBox.Password = "ReadPassword";
    – Mohit S
    Aug 19, 2015 at 7:54
  • PasswordBox doesn't really fits MVVM, but you can write attached behavior to set PasswordBox.SecurePassword (which is SecureString). This behavior has to have access to existing password (again as SecureString in some User class) or put some fake password (but then you can use PasswordBox.Password simply) if e.g. User.IsLogged is set.
    – Sinatr
    Aug 19, 2015 at 7:58
  • @MohitShrivastava - will need to try that one tonight - Care to place it as answer in case it Works for my use case and i award it to you?
    – 537mfb
    Aug 19, 2015 at 14:02
  • @Sinatr Isn't an attached behaviour exactly what i mention as a PasswordBox Helper class that i'm trying to avoid? If not, care to elaborate as answer?
    – 537mfb
    Aug 19, 2015 at 14:04

2 Answers 2

5

You can read the Password from the file.

//Storing the Password in String.
string pwd = "Password Read from the file";
PasswordBox.Password = pwd;

So when the application is open for the first time and there would not be any password in the file it would show the empty PasswordBox. And again when the password has already been set by the user the Password will be found in the file and it would get loaded in the PasswordBox.

1
  • This works - by using an event fired from the viewmodel when in the model the password gets changed. The view responds to that event by setting the PasswordBox's value and MVVM is kept intact - great answer. One should also keep the password in the model using a SecureString rather then a regular string to keep things secure and not negate the PasswordBox's security features
    – 537mfb
    Aug 20, 2015 at 7:08
1

You can have this behavior for PasswordBox to enable binding in MVVM.

PasswordBoxBehavior.cs

public class PasswordBoxBehavior : Behavior<PasswordBox>
{
    public bool ResetPassword
    {
        get { return (bool)GetValue(ResetPasswordProperty); }
        set { SetValue(ResetPasswordProperty, value); }
    }

    // Using a DependencyProperty as the backing store for ResetPassword.  This enables animation, styling, binding, etc...
    public static readonly DependencyProperty ResetPasswordProperty =
        DependencyProperty.Register("ResetPassword", typeof(bool), typeof(PasswordBoxBehavior), new FrameworkPropertyMetadata(false, FrameworkPropertyMetadataOptions.BindsTwoWayByDefault, OnResetPasswordChanged));

    static void OnResetPasswordChanged(DependencyObject depObj, DependencyPropertyChangedEventArgs e)
    {
        PasswordBoxBehavior behavior = depObj as PasswordBoxBehavior;
        PasswordBox item = behavior.AssociatedObject as PasswordBox;
        if (item == null)
            return;

        if ((bool)e.NewValue)
            item.Password = string.Empty;

        behavior.ResetPassword = false;
    }

    private bool isRoutedEventHandlerAssign;
    public string Text
    {
        get { return (string)GetValue(TextProperty); }
        set { SetValue(TextProperty, value); }
    }

    // Using a DependencyProperty as the backing store for Text.  This enables animation, styling, binding, etc...
    public static readonly DependencyProperty TextProperty =
        DependencyProperty.Register("Text", typeof(string), typeof(PasswordBoxBehavior), new FrameworkPropertyMetadata(null, FrameworkPropertyMetadataOptions.BindsTwoWayByDefault, OnTextChanged));

    static void OnTextChanged(DependencyObject depObj, DependencyPropertyChangedEventArgs e)
    {
        PasswordBoxBehavior behavior = depObj as PasswordBoxBehavior;
        PasswordBox item = behavior.AssociatedObject as PasswordBox;
        if (item == null)
            return;

        if (item.Password != e.NewValue as string)
        {
            item.Password = e.NewValue as string;
        }

        if (!behavior.isRoutedEventHandlerAssign)
        {
            item.PasswordChanged += (sender, eArg) =>
            {
                behavior.Text = item.Password;
            };
            behavior.isRoutedEventHandlerAssign = true;
        }
    }

    public PasswordBoxBehavior()
    {
    }
}

Use

<PasswordBox>
    <i:Interaction.Behaviors>
        <bh:PasswordBoxBehavior 
            Text="{Binding UserPassword}"
            ResetPassword="{Binding IsResetPassword}" />
    </i:Interaction.Behaviors>
</PasswordBox>

where

xmlns:i="http://schemas.microsoft.com/expression/2010/interactivity"
xmlns:bh="clr-namespace:<some namespace>;assembly=<some assembly>"
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.