hello, I'm trying to integrate Spring Security in my web application. It seems pretty easy to do as long as you integrate the whole process of authentication and authorization. However, both authentication and authorization seem so coupled that it's being very time-consuming for me to understand how I could split these processes, and...
Is it possible to use AzMan for role based authorization on objects which are created at runtime? If yes how can this be done? For Example: If an object of class "CustomAlert" is created at runtime, I am trying to see if I can have different rules for different objects of the class "CustomAlert". If an object is created by using a spec...
If I launched a shell script using AuthorizationExecuteWithPrivileges what would be the easiest way to kill the script and any other processes that it spawned. Thanks ...
I have an ADO.NET Data Service that exposes an Entity Framework data model (.edmx). I need to allow / reject reads/writes to certain entities for certain users. I use Windows Authentication. All I could find is overriding the OnStartProcessingRequest : protected override void OnStartProcessingRequest(ProcessRequestArgs args) { base...
How do I allow access to my web application to a user, but deny them access to a specific page? I want to allow more uses to use an app I've built, but there are a couple pages I don't want them to be able to access. Here's what I have in the Web.config now. <authorization> <allow roles="COMPANY\User_1"/> <allow roles="COMPANY\Us...
I have the following code that creates a serverside object of the xmlhttp class. I am trying to connect to a site that requires basic authentication. I am able to get this to work with the code below. What's the problem? Well I'm passing the credentials using the open call. That alone is not enough. I must also set the authorizatio...
Hello, I have a simple authorization setup that checks for certain configured active directory roles in a custom authorization policy (IAuthorizationPolicy) - and adds claims if those roles are possessed. On top of that, I have a subclass of ServiceAuthorizationManager which overrides CheckAccessCore. It verifies possession of some of...
I'm using Catalyst with Catalyst::Plugin::Authentication and Catalyst::Plugin::Authorization::Roles and am wondering if there is a better approach to adding an attribute to a model that I'm not seeing. Each user is permitted to access one or more companies, but there is always one primary (current) company at a time. The permitted list ...
The authorize filter allows you to specified group of users that can access a controller or action: [Authorize(Roles="Administrator")] public class HomeController : Controller { // code } I would like to know if it is possible to, instead, specify a group of users that cannot access a controller or action. ...
I'm currently using Ninject2 to bind the various services and repositories in my MVC app. That part seems to be working just fine. Now I'd like to also bind my own class to IAuthorizationFilter and all actions that have the attribute set. I've created a class that inherits from AuthorizationFilter and Implements IAuthorizationFilter. ...
I'm trying to add simple Authentication and Authorization to an ASP.NET MVC application. I'm just trying to tack on some added functionality to the basic Forms Authentication (due to simplicity and custom database structure) Assuming this is my database structure: User: username password role (ideally some enum. Strings if need b...
Hello! I have followed numerous tutorials and walkthroughs/blogs about the capabilities that Ria Services brings to the table when using Silverlight with ASP.Net. Essentially I am looking for a live working example of the authorization functionality that Ria Services can apparently take hold of from ASP.Net. (Even better if it works wit...
We have several existing web applications and SharePoint sites that we want to take off the intranet and make public to authorized external users. There are several commercial Identity and Access Management (IAM) solutions available but I'm trying to find an open source alternative. I would like to avoid building a custom membership pro...
I'm building a community-based site in Rails for the members of a real-world organization. I'm trying to adhere to the best practices of RESTful design, and most of it is more or less by-the-book. The issue that's making my brain run in neat RESTful circles is that of authorization. Authentication is an easy, long-solved problem with wid...
Hi folks, i'm trying to make my own IAuthorizationFilter attribute class. Basically, each api call has a query string parameter called 'key'. I was going to then decorate any actions that require this, with the simple authorisation attribute. I was hoping my OnAuthorization(..) method will then just extract the value of the query param...
I am making a simple application that lets you quickly enter a shell command to be run. It works perfectly, however there is the problem of sudo commands. Currently, it detects a sudo command, and then I try and get it to bring up an authorization window for the user's password, exactly like you would see in Installer. Here's the code o...
I don't know what I am missing, and I don't know what else to read to get it right. I will try this gray question to see if I get closer to the solution. I am building a .NET MVC application. This application is authenticating with OpenID using DotNetOpenAuth Library, all that is working ok. Once a user is authenticate I rebcord th...
I am building a web application using ASP.NET MVC that has two very distinct types of users. I'll contrive an example and say that one type is content producers (publishers) and another is content consumers (subscribers). I am not planning on using the built-in ASP.NET authorization stuff, because the separation of my user types is a di...
I'm looking for the best way to build clean way to build role/authorisaton-based finders? In my model schema, a user can have one of several (admin-defined) roles, such as Administrator, Regional Manager, Sales Assistant: Example Given a User with a Regional Manager role and joined to a Region A, I would like to be able to query what ...
With Domain Driven Design in mind, how would you implement user Authorization in a repository? Specifically, how would you restrict what data you can see by the user provided login? Lets say we have an e-commerce Mall that stores products, where only some products are maintained by any given store manager. In this case, not all produc...