Question about Authorization Manager

Hello,

I have a question about the configuration of tasks and operations, and how they are interpreted by the "Authorize" method of the security application block.

I have created an operation called "Print" and two tasks called "Access Financial Information" and "Print Check".

The definition of "Print Check" includes both the "Access Financial Information" task and the "Print" operation.

When a role is defined as having permission to only the operation "Print" and I attempt to authorize "Print Check", it succeeds. I don't understand why this would be considering the role has not been granted rights to the "Access Financial Information" task.

Could someone enlighten me to why access to lower level tasks are not required in order for authorization of the higher level task to occur? Is this a desired behavior of Authorization Manager, or has something gone awry?
.

Relevant Pages

  • Re: Access 2007 Runtime Security Issue
    ... by default Windows will not allow databases ... probable that you need to authorize the Access application. ... In Windows explorer, Right-click on the .mdb or .mde file and select ... It comes up with a Security alert message. ...
    (comp.databases.ms-access)
  • Re: Using application rolls in SQL Server
    ... > You could let your application authenticate and authorize its users and then use a SQL connection ... that the transmitted password is _not_ ... i dont want to use trusted/integrated security. ...
    (microsoft.public.dotnet.framework.adonet)