.NET ORM and Security

Question

We're going to use an ORM tool with a .NET desktop application. The tool allows creation of persistent classes. It generates all database tables automatically.

In addition to other data, our system needs to store user credentials, and deliver access control.

The question is, is there any possibility of access control by means of ORM, without creating the database authentication mechanisms manually? Is there any product on the market which allows this?

We thought of limiting the access in the program itself, but users can easily access the database directly, and bypass the program limitations.

Thanks.

Answer 1

Looks like a good candidate for using Active Directory authentication.

If this is an option, take a look at System.DirectoryServices namespace. The top two most important classes are the DirectoryEntry and the DirectorySearcher.

Unfortunately, this is not using ORM. But this allows you to develop your own framework block or something like that to accomplish the authentication without having it stored in the underlying datastore.

Otherwise, perhaps the Enterprise Library and the Security Application Block can manage to do something nice for you, that is, only through XML configuration and attributes within your classes.

Answer 2

I assume you mean authentication on the domain objects, which filters back up to the UI, rather than database-access authentication. From the ORMs I've tried, I haven't found any that include role-based authentication on the domain objects, this is usually the job of some other aspect of the system.

You could look at one of the AoP frameworks available, Postsharp is one of the popular ones, here's one of the Postsharp examples:

public class Employee
{
    public string FirstName;
    public string LastName;

    [SecuredData("Manager,HR", "HR")]
    public decimal Salary;
}

Alternatively you could build your own attributes that you decorate your domain objects with, providing each with a role or roles it requires.

Answer 3

An ORM tool is completely client-side. While some might create database objects that store metadata about the ORM itself, they cannot provide any means of actual database security.

If you want to limit access to the database directly and not rely on your application do that authentication (which it sounds like is the case for you), you'll have to use the database's security mechanism; no way around that.