Re: Need help improving authorization

From: Joe Kaplan \(MVP - ADSI\) (joseph.e.kaplan_at_removethis.accenture.com)
Date: 07/22/04

  • Next message: Wes Henderson: "Re: Blocking parent paths (ASP.NET equivalent)" 
    Date: Thu, 22 Jul 2004 11:01:56 -0500

    The basic ideas are that you want to cache the role data, either in a cookie
    (which is what a lot of the forms auth samples show), Session or Cache.
    With a cookie, you need to make sure you encrypt or use an HMAC to ensure
    that the values are not tampered with.

    All three approaches work fine and have their good points and bad points as
    with any user state persistence requirement.

    Joe K.

    "Shaun" <Shaun@discussions.microsoft.com> wrote in message
    news:F571DD66-4B6A-4151-8E7F-4B273F0F1724@microsoft.com...
    > There are a few pages out there with methods for this, the one I used is
    http://www.dotnet247.com/247reference/msgs/14/72098.aspx (you can find
    vb.net and c# versions, although changing the code is not difficult).
    >
    > Once you've used the code you find there you can check the roles using the
    IsInRole method.
    >
    > Hope this helps.
    >
    > --------------------------
    > Shaun Venus
    >
    > emailid: sunevnuahs
    > domain: hotmail.com
    > --------------------------
    >
    >
    > "AndiV" wrote:
    >
    > > I don't have a response in framework.aspnet, may be this one is a more
    > > appropriate group.
    > >
    > > = = = = = = = = = = = = = = = = == = = = = = == = = = = = = = = = = = =
    = =
    > > = = =
    > >
    > > Each of my intranet page (windows authentication) needs to validate
    user's
    > > roles stored in the database. Currently, I retrieve the the
    > > User.Identity.Name property, then query the database for user's roles
    > > everytime a page is loaded, which is very inefficient.
    > >
    > > I think a more efficient approach would be to query the database only
    once
    > > for each user, the application_start event is probably the best place?
    Once
    > > this particular user's roles are retrieved, the roles can be
    concatenated as
    > > a delimied string and stored in cookie or a session variable. Then on
    each
    > > page load event, I just have to parse the roles string to apply
    > > authorization.
    > >
    > > I believe this scheme will work. But it seems more like a hack than a
    design
    > > pattern or a best practice. I'm seeking a .NET elegant solution. Please
    > > advise.
    > >
    > > TIA,
    > > Andi
    > >
    > >
    > >
    > >

  • Next message: Wes Henderson: "Re: Blocking parent paths (ASP.NET equivalent)"

    Relevant Pages

    • [PATCH 1/4] Split general cache manager from CacheFS
      ... FS-Cache now mediates between cache backends and network ... +struct fscache_cache_ops; ... +void fscache_relinquish_cookie(struct fscache_cookie *cookie, ...
      (Linux-Kernel)
    • Re: Role Providers Cache
      ... do our own cache using the cache management API. ... farm environment with out of process session state. ... Auth Manager Role Provider or use the SQL Role provider (moving the roles ... So my main concern was on the cache feature and the cookie was worried we ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: OT (happy, steve?): computer illiterate
      ... Obviously the result of all those porno sites you visit. ... Clear out the Internet Exploder cache file, History and Cookie jar. ...
      (misc.fitness.weights)
    • Re: my email and keyboard
      ... Your web mail page might have a corrupt file in the cache, ... Clear the IE cache. ... 278835 - How to Delete Cookie Files: ... > the carib Recently iam having problems with my keyboard and email. ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: [PATCH 0/12] FS-Cache: Generic filesystem caching facility
      ... Whilst it is a case of what you want is not in the cache (or was ... All reads on that cookie will return ENODATA until at ... which there's definitely nothing in the cache, and gracefully refuse to ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)