(Thanks ever so much for the reply, btw. It's a good start for me :)
Tom Porterfield <tpporter@mvps.org> wrote:[color=blue]
> We do this using Windows Authentication with our security data stored in
> a SQL server database. On the server we create our own principal object
> that inherits from WindowsPrincipal.[/color]
Any reason for using Windows Authentication here rather than any of the
other types?
[color=blue]
> In Global.asax in the
> AuthenticateRequest handler we replace the HttpContext.Current.User with
> our principal object, passing HttpContext.Current.User.Identity as
> WindowsIdentity to the constructor. Our principal object overrides the
> two overloads of IsInRole to use our own security check. We have also
> added a HasPermission method to our principal so we can demand a
> permission whenever we need to. So our AuthenticateRequest handler
> looks as follows:
>
> protected void Application_AuthenticateRequest(Object sender, EventArgs e)
> {
> // this will throw an exception if windows auth not turned on[/color]
How does the behaviour differ between the situation where the user
actually *is* a valid Windows user for the system, and where they're
not? Isn't ASP.NET or IIS going to have tried to use whatever the
client provides as Windows authentication by now?
[color=blue]
> // Also note we have to set the context here since ASP.NET will take
> // what's in the context and place it on the Thread.CurrentUser property
> CustomServerPrincipal princ = new CustomServerPrincipal as
> WindowsIdentity);
> HttpContext.Current.User = princ;[/color]
Any reason for doing it as WindowsIdentity rather than just setting it
as a CustomServerPrincipal?
Presumably before setting the value you check whether the user/password
combination is valid?
[color=blue]
> // verify that this user is authorized to get into Polaris
> if (!princ.HasPermission(authUserPerm))
> {
> throw new
> CustomSecurityException(String.Format(securityExce ptionMessage,
> princ.Identity.Name));
> }
> }[/color]
Does the type of exception matter here, out of interest?
[color=blue]
> In any server side objects where we need to demand a permission, we now
> simply take the current principal from the thread as our custom
> principal and demand the permission. Ex:
>
> CustomServerPrincipal principal =
> System.Threading.Thread.CurrentPrincipal as CustomServerPrincipal;
> if (!principal.HasPermission(deletePermission))
> {
> throw new CustomSecurityException(principal, deletePermission);
> }[/color]
Right - that bit I think I'm reasonably happy with.
--
Jon Skeet - <skeet@pobox.com>
http://www.pobox.com/~skeet
If replying to the group, please do not mail me too
