How to integrate access control with my ORM in a .net windows form application?

Question

I am developing a general database query tools, a .Net 3.5 Windows Form application. In order to make the presentation layer is independent of the database layer. I use an ORM framework, XPO from DevExpress.

But, I have no access control function built in. I surfed Internet and I found in WCF Data Services, there is an interesting concept, Interceptor, which is following AOP(Aspect Oriented Programming).

I am wondering who has such an experience to build access control in ORM. My basic requirement is :

1. It should be a general method and controlled by users in runtime. So any hard coding is not acceptable.
2. It could be based on attribute, database table, or even an external assembly.

I am willing to buy a ready solution. According to the idea of AOP, an access control function can be integrated with existing functions easily and nearly not knowingly to the previous developer;)

Any suggestions are welcome.

Answer 1

I'm not sure that this answer will be helpful in your situation, but it can be interesting for you.

X-tensive company (developer of DataObjects.Net ORM) plans to implement similar feature for DataObjects.Net in few months. X-tensive's plan is to provide full featured ready to use security extension, possibly based on attributes and aspects. Surely it will be closely connected with this ORM, but you can derive some ideas from its description. See feature request and its discussion here.

You can also take a look at Rhino Security, I don't know current status of this project, but it seams such solution can be useful in your case.

Answer 2

Why not build a layer between the ORM and the presentation layer? By doing this separation you can easily switch data sources (in the future you might have your data on another server and access it through web services). I'm sure that there are a fancy name for this layer, but I call all my interfaces for managers.

Presentation -> Managers -> Data Access Layer -> DB

Example:

var user = Program.Components.Get<IUserManager>().GetById(1);
user.FirstName = "Jonas";
Program.Components.Get<IUserManager>().Save(user);

In the managers you can use IIdentity and IPrincipal (built in access control interfaces in .Net) to control access. http://msdn.microsoft.com/en-us/library/ms172765(VS.80).aspx