tags:

views:

66

answers:

2

I'm using something like this on my server:

TcpServerChannel channel = new TcpServerChannel(settings.RemotingPort);
ChannelServices.RegisterChannel(channel, true);
RemotingServices.Marshal(myRemoteObject, "myRemoteObject");

I would like to subscribe to some kind of event so that whenever a remote client connects to myRemoteObject, I can check the Thread.CurrentPrincipal.Identity.Name to decide whether to authorize him.

Currently I'm doing the authorizing check in every exposed remote method of myRemoteObject which is a messy...

+1  A: 

You could use something like PostSharp to factor out the check from every method - just do it in the AOP advice. (You apply this to the class which is exposing its methods, not to the client connection.)

This approach is independent of whatever transport you use for remoting - it just factors out the cross-cutting concern of authorization across all the methods in your remoted class.

Vinay Sajip
Thank you, this is interesting I was also wondering if there is a way I can use custom attributes to do some pre/post method logic.
chuanose
PostSharp uses custom attributes - see the video: http://www.postsharp.org/about/video
Vinay Sajip
+1  A: 

In my remoting application i defined a special object/interface where clients first need to authorize. The special object then returns, if the client successfully authorized the remote object. So you have the authorization at one place.

It looks something like this.

public interface IPortal
{
  object SignIn(string name, string password);
}

public class Portal : MarshalByRefObject, IPortal
{
  private object _remoteObject;

  public Portal() {
    _remoteObject = new RemoteObject();
  }

  public object SignIn(string name, string password) 
  {
    // Authorization
    // return your remote object

    return _remoteObject;
  }
}

In your application you host the Portal-Object

TcpServerChannel channel = new TcpServerChannel(settings.RemotingPort);
ChannelServices.RegisterChannel(channel, true);
Portal portal = new Portal()
RemotingServices.Marshal(portal , "portal");
Jehof
This is neat, but does not allow different authorizations for different methods. (Which may be OK for this question's use case.)
Vinay Sajip
This is right. But you can return diffrent remote objects for each user. Each remote object can have it´s own permissions.
Jehof
Thanks, this will be suitable for my case as I don't need per-method authorization.
chuanose