Through most of my dev experience, I've never had to deal with much variety of access control architectures.
They've all been pretty straight forward:
Group [Create, Update, Delete] - User 1 - User 2 Group [Update, Delete] - User 2
Which, for all intents and purposes, works well. The problem I have is the actual implementation of it. All the solutions I've worked on either grant/deny the visibility of a menu link, or disable a button etc. This is all controlled via the top-most layer of the app, whether it be a WebApp or WinForms UI.
I'm in the early stages of designing a rather large WinForms system so I'd like to get the security architecture right from the beginning.
Although I don't see myself getting away from visually limiting the user from performing certain actions (by disabling restricted controls etc), I'm sure there are better solutions available then doing most of the work in the UI.
As I understand it (and these might be limited by my ignorance), these are my options:
- Put the logic to return and verify user rights in the business layer
- On the form_load event, get these rules and enable/disabled UI elements
- Leave the UI elements in tact and halt the operation from within the business layer if the user doesn't have permission for the action (dirty!)
Surely there must be more elegant solutions than this. Could someone please provide me with alternatives or improvements to the aforementioned ideas?
Am I thinking about it incorrectly? Should I re-evaluate my database design while I'm at it?