Custom Security question
From: Brett (brettwinters_at_NOSPAMhotmail.com)
Date: 10/31/03
- Next message: Sky Fly: "Cryptographic Service Provider problem"
- Previous message: Mick Badran: "ebXml spec. XmlSign - anyone implemented?"
- In reply to: Cole Shelton: "Custom Security question"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 31 Oct 2003 01:46:22 -0800
Cole,
This is exactly the approach that I have taken. The
problem with roles (only) is that they need to be defined
in advance and hardcoded into the application. The benefit
with having an intermediate permissions list is that you
can define intrinsic permissions for a part of your
application like ("CanDelete", "CanUpdate", etc - perhaps
even "Company = 2") and then assign roles to various
combinations of permissions at the application settings
level. There is a java (shock horror!) example at
(http://developer.java.sun.com/developer/Books/ejbtechnolog
y/ch14.pdf) on page 21, but you lose the ability to
User.IsInRole("Admin")
In the end I decided to create a custom IPrincipal with a
shadow Permission list (a copy of the Role list) so you
get MyPrinciple.HasPermission("CanDelete") - of course
you lose declarative security...
Another way is to think "permission" when you work with
roles in IPrincipal and handle the assignment of roles to
permissions at an application settings level.
But all this is not very elegant, so I would be interested
if someone has a better solution perhaps along the java or
Microsoft code access security line. I heard that a
security application block was in the works?
Let me know how you get on...
Regards
Brett
>-----Original Message-----
>Hi all,
>
>I am wanting to implement a custom security solution for
my app, but am not
>quite sure how to implement it. Basically, I will have
database tables
>which will store Users, Roles, and Permissions.
>A user can be in multiple Roles and each Role has
Permissions associated
>with it. I understand the Identity and Principal
classes, but am quite
>confused when it comes to Permission. I don't want Code
Access Security, I
>simply want to be able to check if a user has a certain
permission based on
>the Roles they are associated with. Is there a way I can
do this be
>implementing IPermission, or do I just need to skip
IPermission altogether??
>
>Thanks,
>Cole Shelton
>Interworks, Inc
>
>
>.
>
- Next message: Sky Fly: "Cryptographic Service Provider problem"
- Previous message: Mick Badran: "ebXml spec. XmlSign - anyone implemented?"
- In reply to: Cole Shelton: "Custom Security question"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
