Extending Active Directory security with actions and roles

Question

We are building an intranet application that would use integrated windows authentication. The application would require custom actions and roles to secure different parts and functions.

My current idea is to extend active directory by storing the roles and actions in a different database linked to an active directory user using the SID. That way we know who the user is and fetch his allowed roles (with the actions) from our database without much hassle.

Do you think this is a good approach or are there better ways of dealing with these things?

I have read this post: http://stackoverflow.com/questions/726837/user-group-and-role-management-in-net-with-active-directory
But Active Directory does not support programmatically creating roles and there is no support for custom actions whatsoever.

Answer 1

A couple of options spring to mind:

• you could use ADAM (aka AD LDS) for your roles store - the programming model is the same as AD, which is nice;
• you could us AzMan (aka Authorization Manager) - it integrates nicely with ASP.NET and you can use it with the builtin Roles provider. It can store its data in XML or in the AD. Also, the EntLib comes with an AzMan wrapper so you've another way to use it. I quite like AzMan because you can make changes to user roles on the fly.