Currently our team develops Web Applications and now we are going to Windows Forms applications.

I have created the inception phase for our Windows Forms project structure.



--> Security Project(Login Authentication) 

         a. Users will be registered with different applications in our application database.
           eg: ProjectApplicationId|ProjectName        | UserId
               1                   |ProjectApplication1| user
               2                   |ProjectApplication2| user 

         b. Execute Application (Start) 
         c. On Security dialog, application automatically get the userid of the user and see all the application it is registered using System.Security.Principal.WindowsIdentity.GetCurrent()
           eg: Prototype
              Welcome User! Please Choose Appliations you are registered on below:
                                 ProjectApplication1 <--this will be a dropdown
              Password: [*********************]
              [Access Application Button] 
         d. User selects the application with its password
         e. If the password is incorrect (application.exit()) else execute Selected Application 
             eg: ProjectApplication1 is selected then execute ProjectApplication1

--> ProjectApplication1

--> ProjectApplication2

--> Many to come ++

        if ProjectApplications has been closed then restart security Application.

My questions on this use case:

  1. Is my use case possible?
  2. Can you give me any recommendations ?

Currently we use setup and deployment to create installer in each Windows Forms application.

  • 4
    I recommend using WPF to develop your application instead of WinForms.
    – Bernard
    Mar 8, 2012 at 2:18
  • 1
    I'm sorry to say that you seem to be a bit out of date. You realize that there is a beta out now for Visual Studio 11, right?
    – Bernard
    Mar 8, 2012 at 2:25
  • 3
    VS 2008 supports WPF.
    – NoChance
    Mar 8, 2012 at 2:27
  • 1
    You won't need to have MDI windows - sounds strange but it can actually work really well. It'll take quite a while for you to get your head around it, but you definitely should be developing in WPF now - winforms is out of date.
    – Rocklan
    Mar 8, 2012 at 3:33
  • 1
    IMHO WPF is a red herring and a potential "holy war starter". WinForms is older, of course, and does not support dpi independent GUIs. WPF is newer, supports Silverlight and may have the better architectural design, of course. On the other hand, the WinForms designer in Visual Studio is still more mature and stable than the WPF designer, and you won't need to buy a second tool like Expression Blend (what you need if you want to do WPF seriously).
    – Doc Brown
    Mar 8, 2012 at 7:13

4 Answers 4


I've developed both desktop applications and web applications and mixture of both (dual interfaces Fat and Thin clients).

So long as you have a good client-server (database back end) architecture.

It should not matter what the front end is (web application, desktop application, mobile application).

After re-reading your question it makes no sense?


Ok, just re-re-read your question.

Basically just have a login screen, once the user logs in you simply store the ID in memory (think session ID).

The user is then presented with a screen that shows ALL Project Applications (that they have access to).

They can then click any any one to access it. Pretty straight forward.


Instead of diving into the details of security authentification too soon, I would strongly recommend to focus on the "real" or "business" use cases first, and what kind of application system you have in mind (in terms of number of expected users, expected lifetime of the application, general security requirements depending on the types of data available, general platform considerations like Winforms vs. WPF etc.) Otherwise you take the risk of loosing yourself into unimportant details.

Analysing things like "authentification" first is most often a sign that you have not took enough time to understand the business domain and try start with those things where you don't need any understanding of the domain.


I see the following with your Use Case:

  1. You have skipped the details for entering userid and the associated validations.

  2. You are getting into details such as the display of the message "welcome user..." - This kind of details is best explored on a GUI prototype not on the use case.

Things that are not clear:

c1 - How does the application start - There is no step showing this.

c2 - Do you assume that the applications displayed are for this userid? If so, your use case should say that.

c3 - Does the user has to enter an Password?

c4 - How many times could the user enter his/her credentials?

c5 - What if the user wants to exit at some point, is it possible - How?

  • Still not clear on C1 (how does the application start from windows?). C4 is still not clear. Also, how many versions of the application would run at the same time?
    – NoChance
    Mar 8, 2012 at 8:11
  • c1.If all projects can be compressed in only one installer it will only have one executable file(secutiryApllication.exe) c4.only one version on selected application on security
    – john ryan
    Mar 8, 2012 at 8:26

c) "On security dialog..."

Automatically pulling a user id from an identity provider is a very convenient attribute of a system from a user's perspective. However, I am not sure I would specify the provider to this level of detail in the use-case, though. In addition, I would also want to specify and provide a fall-back method of providing a user-name to the security dialog in the event that the specified [default] provider is situationally not appropriate or unavailable for the user. More than likely, a manually typed entry-mode of the username.

Are the passwords for users unique to each project? If they are unique for each user on each project, the flow you presented makes sense. Otherwise, if each user has only one password, regardless of project, I would require the password before presenting or suggesting a choice of project.

e) "If the password is incorrect..."

I try to favoring only checking for the positive in the default case. Here, I only want to know whethere the password was validated for the particular username. Besides a common case of the incorrect password, there are be numerous other cases that would need similar handling to the incorrect password. So in short, I would restate the step as:

If Password is validated, execute/present...else notify with reason not validated (incorrect/mismatch, connection issue, maintenance locked, load/license locked, access revoked, etc) and [allow/deny] retry.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.