Customizable Role-based Authorization

[Snig]

Hi all

I need to implement the following scenario in my application:
1. Roles are stored in SQL-SERVER.
2. Access Rights will be given to the roles by the administrator by the
application itself.
3. Access Rights will be given on functionality basis. e.g. some role
can Add a new record, some can search for some particular records, some
can update it etc. We have these functionality implemented by standard
buttons in pages. Let's call these as "Access Areas".
4. There are huge number of such Access Areas to be implemented in
various pages. Though they are finite (means administrator cannot
create/delete these access areas), but he can change the permission
over an Aceess Area to a role.

Solutions I thought:
1. I can, of course, write few lines in individual pages, read the
settings from database and apply. But I want to do this centrally, like
in application_authorizerequest event of global.asax file.
2. I can create custom/user controls for each of the Access Areas and
implement security model onto that. But, we have developed the
application too far before the customer has made this request.

In this scenario, can somebody help me about how should I design the
security model?

Thanks
Snig.

[Steve C. Orr [MVP, MCSD]]

I successfully developed an app using role-based forms authentication by
using the techniques outlined in these articles:

http://support.microsoft.com/default...b;en-us;311495
http://www.4guysfromrolla.com/webtech/121901-1.2.shtml

Here is another article you may find useful as well:
http://www.eggheadcafe.com/articles/20020906.asp

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://SteveOrr.net
"Snig" <sn****@yahoo.co.in> wrote in message
news:11**********************@z14g2000cwz.googlegr oups.com...

Hi all

I need to implement the following scenario in my application:
1. Roles are stored in SQL-SERVER.
2. Access Rights will be given to the roles by the administrator by the
application itself.
3. Access Rights will be given on functionality basis. e.g. some role
can Add a new record, some can search for some particular records, some
can update it etc. We have these functionality implemented by standard
buttons in pages. Let's call these as "Access Areas".
4. There are huge number of such Access Areas to be implemented in
various pages. Though they are finite (means administrator cannot
create/delete these access areas), but he can change the permission
over an Aceess Area to a role.

Solutions I thought:
1. I can, of course, write few lines in individual pages, read the
settings from database and apply. But I want to do this centrally, like
in application_authorizerequest event of global.asax file.
2. I can create custom/user controls for each of the Access Areas and
implement security model onto that. But, we have developed the
application too far before the customer has made this request.

In this scenario, can somebody help me about how should I design the
security model?

Thanks
Snig.

[Snig]

Thanks Steve.

Can the mechanism referred by the links provided by you handle the
enabling/disabling of controls of a particular page?
Please note that the authorization should be applied on control/field
level instead of the whole page ...

Snig.

[Steve C. Orr [MVP, MCSD]]

With a drip of code here and there you can do anything you want with the
controls in the page.

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://SteveOrr.net
"Snig" <sn****@yahoo.co.in> wrote in message
news:11*********************@o13g2000cwo.googlegro ups.com...

Thanks Steve.

Can the mechanism referred by the links provided by you handle the
enabling/disabling of controls of a particular page?
Please note that the authorization should be applied on control/field
level instead of the whole page ...

Snig.

[Snig]

Well, thats what I was trying to assert.
The security model implementation should not be scattered here and
there!

Can I control the whole security framework in global.asax file itself
by implementing custom HTTPModule?

[Steve C. Orr [MVP, MCSD]]

This sounds possible, but not very easy in ASP.NET 1.x.

The new capabilities in ASP.NET 2.0 will provide enhanced capabilities in
this area.

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://SteveOrr.net
"Snig" <sn****@yahoo.co.in> wrote in message
news:11*********************@l41g2000cwc.googlegro ups.com...

Well, thats what I was trying to assert.
The security model implementation should not be scattered here and
there!

Can I control the whole security framework in global.asax file itself
by implementing custom HTTPModule?