Customizable Role-based Authorization

[Snig]

Hi all

I need to implement the following scenario in my application:
1. Roles are stored in SQL-SERVER.
2. Access Rights will be given to the roles by the administrator by the
application itself.
3. Access Rights will be given on functionality basis. e.g. some role
can Add a new record, some can search for some particular records, some
can update it etc. We have these functionality implemented by standard
buttons in pages. Let's call these as "Access Areas".
4. There are huge number of such Access Areas to be implemented in
various pages. Though they are finite (means administrator cannot
create/delete these access areas), but he can change the permission
over an Aceess Area to a role.

Solutions I thought:
1. I can, of course, write few lines in individual pages, read the
settings from database and apply. But I want to do this centrally, like
in application_authorizerequest event of global.asax file.
2. I can create custom/user controls for each of the Access Areas and
implement security model onto that. But, we have developed the
application too far before the customer has made this request.

In this scenario, can somebody help me about how should I design the
security model?

Thanks
Snig.

[Dominick Baier [DevelopMentor]]

Hello Snig,

I would go for Application_AuthorizeRequest - this can be global.asax or
better a HttpModule which handles this event.

You have everything you need to know at this stage - requested page and username
as known to the application.

---------------------------------------
Dominick Baier - DevelopMentor
[url]http://www.leastprivilege.com[/url]

> Hi all
>
> I need to implement the following scenario in my application:
> 1. Roles are stored in SQL-SERVER.
> 2. Access Rights will be given to the roles by the administrator by
> the
> application itself.
> 3. Access Rights will be given on functionality basis. e.g. some role
> can Add a new record, some can search for some particular records,
> some
> can update it etc. We have these functionality implemented by standard
> buttons in pages. Let's call these as "Access Areas".
> 4. There are huge number of such Access Areas to be implemented in
> various pages. Though they are finite (means administrator cannot
> create/delete these access areas), but he can change the permission
> over an Aceess Area to a role.
> Solutions I thought:
> 1. I can, of course, write few lines in individual pages, read the
> settings from database and apply. But I want to do this centrally,
> like
> in application_authorizerequest event of global.asax file.
> 2. I can create custom/user controls for each of the Access Areas and
> implement security model onto that. But, we have developed the
> application too far before the customer has made this request.
> In this scenario, can somebody help me about how should I design the
> security model?
>
> Thanks
> Snig.

[Snig]

Thanks Baier.

Well, in Application_AuthorizeRequest event, I do have the requested
page, username etc. But how can I enable/disable the controls of that
page depending on the settings in this event?
Please note that the authorization should be applied on control/field
level instead of the whole page ...

Snig.

[Dominick Baier [DevelopMentor]]

Hello Snig,

aah - i see.

In that case you will have to do it on the page - other things to think about

factor the links out to a ASCX file, or use a new base class (derived from
page) to do the common stuff.

---------------------------------------
Dominick Baier - DevelopMentor
[url]http://www.leastprivilege.com[/url]

> Thanks Baier.
>
> Well, in Application_AuthorizeRequest event, I do have the requested
> page, username etc. But how can I enable/disable the controls of that
> page depending on the settings in this event?
> Please note that the authorization should be applied on control/field
> level instead of the whole page ...
> Snig.
>

[Snig]

Yes, thats seems to be a work-around ...

the problem is we didn't architected the application in this way, as
this security framework is a new requirement from the customer.

thanks Baier, is there some other ways ?

Snig.