Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems (preferably with code samples) and perhaps a list of pros/cons for each method.

I've seen examples using simple dictionaries, custom attributes, claims-based authorization, and custom frameworks, but I can't find a simple explanation of when to use one over another and what the pros/cons are to using each method. (I'm sure there's other ways than the ones I've listed...)

I have never done anything complex with permissions/authorization before, so all of this seems a little overwhelming to me, and I'm having trouble figuring out what what is useful information that I can use and what isn't.

What I DO know is that this is for a Windows environment using C#/WPF and WCF services. Some permission checks are done on the WCF service and some on the client. Some are business rules, some are authorization checks, and others are UI-related (such as what forms a user can see). They can be very generic like boolean or numeric values, or they can be more complex such as a range of values or a list of database items to be checked/unchecked.

Permissions can be set on the group-level, user-level, branch-level, or a custom level, so I do not want to use role-based authorization. Users can be in multiple groups, and users with the appropriate authorization are in charge of creating/maintaining these groups. It is not uncommon for new groups to be created, so they can't be hard-coded.

share|improve this question

closed as too broad by gnat, GlenH7, MichaelT, Kilian Foth, Snowman Aug 27 '14 at 4:22

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

Can you define "system"? Are you looking for a complete top-to-bottom system, i.e. that integrates with Active Directory or has its own administration tools for managing everything? The .NET Framework already has a ton of this functionality built into the Identity Model - it's all based on claims and claim sets. – Aaronaught Apr 29 '11 at 18:48
@Aaronaught Anything... it could be a third-party library for permissions-based authorization, or it could be a simple explanation how how to build one and how/why it works. I'd prefer to know how something is built and why it is built that way. I'm just lost as to where to start, or how to build it. – Rachel Apr 29 '11 at 18:51
Well, for WCF, you really should check out that link and that whole area of MSDN; I'm loath to submit such a trite statement as an answer but that really is all you need. You set up a ServiceAuthorizationBehavior, which presents a ServiceAuthorizationManager, which has access to the policies and gets to validate every OperationContext before the operation executes. – Aaronaught Apr 29 '11 at 18:56
2… may have useful advice for you. – btilly Apr 29 '11 at 18:59

There is Rhino Security. Ayende has a handful of blog posts about it.

Another blog has a couple of articles on it, too.

It is possible to use it with S#arp Architecture as well.

share|improve this answer
Rhino looks like it can only be used with NHibernate, and I am using EntityFramework. Is this correct? – Rachel Apr 29 '11 at 18:49
As it is currently implemented, it does depend on NHibernate. However, it can certainly provide as an example and Ayende's blog posts can lend insight into the decisions that go into designing an authorization component. – quentin-starin Apr 29 '11 at 19:44
You did after all ask for examples and sample code and discussion of pros/cons, rather than asking for a ready-to-roll component that can be plugged directly in with EF. – quentin-starin Apr 29 '11 at 19:46
True, thanks for the example – Rachel Apr 29 '11 at 20:07

We had UI-level authorization implemented at the control level. We had the authorization control level details for each view stored in the database. During run time the base class was doing the heavy lifting in deciding which user could see/ use which control on the rendered form. We had a constraint of not using any third-party library...

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.