Dynamic Checking of Roles - Enterprise Services

From: Jeff (jeff.noble@no.glhomes.spam.com)
Date: 12/30/02 

From: "Jeff" <jeff.noble@no.glhomes.spam.com>
Date: Mon, 30 Dec 2002 10:43:26 -0800

Hello,

I am trying to make a generic class to handle COM+
security in ASP.net.

I had hoped to pass the name of a method and the current
users identity from ActiveDirectory (from the
ContextUtil), to a function and have that function check
to see if the user is in a role to access that method.

I know about IsCallerInRole(), but that only checks the
current method, since I am trying to create a base class
to do these checks, I will always be calling a function
(ie: CheckCredentials
("foo",SecurityCallContext.CurrentCall.OriginalCaller.Acco
untName))

I also do not want to name the Role in code for a call to
IsCallerInRole(<role>).

I basically am looking for a way to enumerate the
methods, then enumerate the roles for a method and check
if the current user is in one of those roles. Is this
possible? What are my options?

I am sure this is not a new question as the same dilemma
exists for VB6 and COM+. By getting the role names out of
the code, I can easily have an implementation/security
team create roles at the method level to control
security. And by standardizing the method level checks, I
can inherit from a base class that already knows how to
do the checks.

Thanks in advance for any help!

Jeff
jeff.noble@no.glhomes.spam.com
(remove the no. and spam. to reply)

Relevant Pages

  • Re: COM+ Method level security problem
    ... Plost post an extraction of the class to see how exactly you use the ... Enterprise Services ... > I'm trying to use COM+, method level security... ...
    (microsoft.public.dotnet.framework.component_services)
  • COM+ Role Based Security - calling secure method 1 from secure method 2
    ... I have implemented role-based security on some serviced componts at ... However, method level isn't granular ... Should a user be in an applicable role, ...
    (microsoft.public.dotnet.framework.component_services)
  • Re: Restrict user navigation
    ... One approach I have done is to write my own class that inherits from ... In this I write my security handling routine and this ... base class doesn't have any associated aspx of its own but in every web page ... If you decide to do this then I found it best to include the security ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • COM+ Method level security problem
    ... method level security... ... Have a vb.net dll class that inhertis from servicedcomponent, ... strong name, TLB, registered in GAC and COM+. ...
    (microsoft.public.dotnet.framework.component_services)
  • RE: Modem detection in a LAN
    ... When doing research for a RestrictAnonymous article for Security Focus, ... wrote a series of little apps to enumerate net info with the NULL ... With NT4 boxes, the tool was great as it could run against a machine as ...
    (Pen-Test)