ansaurus

Question

Question regarding fine-grained authorization and MVC2

Answer 1

A:

I think you're being too quick to dismiss the role provider. If a user had a role called NewsAdmin_Europe_AddNews that would pretty much answer the question, wouldn't it?

Once you've made your authentication scheme work with the role provider, you need to tie that into MVC. Subtype AuthorizeAttribute and override AuthorizeCore. Warning: Your code here must be thread-safe and re-entrant. Call base.AuthorizeCore and then test for the specific role based on the URI/query (you won't get route values since this can be served from cache, bypassing MVC altogether).

This is some work, but will be more secure in the end than trying to reinvent membership.

Craig Stuntz 2010-07-29 14:00:03

I considered using something similar to NewsAdmin_Europe_AddNews but that would prevent me from easily adding "DeleteComments" access to the NewsAdmin role. I'd need to create NewsAdmin_%s_DeleteComments in stead.

Thomas 2010-07-29 14:52:36

They are different roles. Use one role per permission. The Role provider is built around this idea. To clarify: To you, "NewsAdmin" is a role. That's fine, but it's a different role than "NewsAdmin_Europe_DeleteComments", which is important to the provider. The provider's concept of a role includes both what you consider roles and what you consider "permissions".

Craig Stuntz 2010-07-29 15:32:51

You are completely right. To me NewsAdmin is the role, and "add, edit, etc" are separate permissions that make up that role. Conceptually the Role provider concept seems, well, unsalable and unmaintainable. (I'm hopefully wrong, though). In a real-world application, how would one add "NewsAdmin_Europe_DeleteComments" role to all users who have a "NewsAdmin_Europe_*" role ?Another issue is, that it would clutter a UI to have those 4 roles for each leaf under Europe aswell, rather than just having "NewsAdmin" in X, Y and Z.Thanks for your time. I'll head off to read some

Thomas 2010-07-29 17:59:55

I would probably use AzMan to map a hierarchy of roles+permissions onto role provider roles and then use the AzMan role provider in my app. It does exactly what you're asking.

Craig Stuntz 2010-07-29 18:29:15

ansaurus

tags:

views:

answers:

Question regarding fine-grained authorization and MVC2

related questions