clever friday code
Hey all,
I'm looking for a way to get at the value of the parameter of a method
call from a custom attribute.
[RequiresJobRole(JobRole.site_data_entry)]
public void GetPerson(int personId)
{
// Do stuff if authorised
}
Then in the attribute
protected override AuthorizationResult IsAuthorized(IPrincipal
principal, AuthorizationContext authorizationContext)
{
// For inserts and updates I can check the Entity being
operated on via something like this
var person = authorizationContext.Instance as PersonalDetails;
// But its null if I'm doing a Query / read.
var hasPermission = // getThe int personId that the method
was called with and check they have access. Is this even possible?
if (hasPermission)
{
return AuthorizationResult.Allowed;
}
return new AuthorizationResult("You do not have permission
to access this person.");
}
I can do this with Inserts, Updates and Deletes. Calling a method to
do a view or query seems impossible. How do I know what they are
trying to view? user permission is based on the Id of the item they
are looking up. There's a stored proc that goes off and returns their
permission mask on the items they are accessing. Problem is I can't
tell what they are trying to view.
The other solution is to put a user validation call at the top of each
method like so;
public void GetPerson(int personId)
{
if(UserHasAccess()){
// Do stuff if authorised
}
else{
throw new SecurityAccessException("go away");
}
}
but a single Attribute on the method would be cleaner. Otherwise have
to put that code all over the place...
cheers,
Stephen
RE: clever friday code
Hi Stephen,
It sounds like you're trying to do the right thing and reduce boiler-plate
code, but the approach seems a little awkward.
I'd be inclined to adopt a "decorator" pattern on this to get your security to
work.
Basically have an inner implementation of your methods without security and
then an outer, publicly exposed class that only have security and have it defer
to the inner class to do the work.
Sort of like this:
public class Repository
{
private RepositoryImpl Inner = new RepositoryImpl();
public Customer GetCustomer(int customerId)
{
RequireOrThrow(JobRole.site_data_entry, "You do
not have permission to access this customer.");
return this.Inner.GetCustomer(customerId);
}
}
internal class RepositoryImpl
{
public Customer GetCustomer(int customerId)
{
//Do stuff to get customer - no security code
}
}
I've over simplified it, but how does that sound?
Cheers.
James.
-Original Message-
From: ozdotnet-boun...@ozdotnet.com [mailto:ozdotnet-boun...@ozdotnet.com] On
Behalf Of Stephen Price
Sent: Friday, 20 May 2011 16:59
To: ozDotNet
Subject: clever friday code
Hey all,
I'm looking for a way to get at the value of the parameter of a method
call from a custom attribute.
[RequiresJobRole(JobRole.site_data_entry)]
public void GetPerson(int personId)
{
// Do stuff if authorised
}
Then in the attribute
protected override AuthorizationResult IsAuthorized(IPrincipal
principal, AuthorizationContext authorizationContext)
{
// For inserts and updates I can check the Entity being
operated on via something like this
var person = authorizationContext.Instance as PersonalDetails;
// But its null if I'm doing a Query / read.
var hasPermission = // getThe int personId that the method
was called with and check they have access. Is this even possible?
if (hasPermission)
{
return AuthorizationResult.Allowed;
}
return new AuthorizationResult("You do not have permission
to access this person.");
}
I can do this with Inserts, Updates and Deletes. Calling a method to
do a view or query seems impossible. How do I know what they are
trying to view? user permission is based on the Id of the item they
are looking up. There's a stored proc that goes off and returns their
permission mask on the items they are accessing. Problem is I can't
tell what they are trying to view.
The other solution is to put a user validation call at the top of each
method like so;
public void GetPerson(int personId)
{
if(UserHasAccess()){
// Do stuff if authorised
}
else{
throw new SecurityAccessException("go away");
}
}
but a single Attribute on the method would be cleaner. Otherwise have
to put that code all over the place...
cheers,
Stephen
Re: clever friday code
That would help a lot, hadn't thought of it from that angle.
thanks, will try that out and see how it feels. :)
cheers,
Stephen
On Fri, May 20, 2011 at 4:52 PM, James Chapman-Smith
wrote:
> Hi Stephen,
>
> It sounds like you're trying to do the right thing and reduce boiler-plate
> code, but the approach seems a little awkward.
>
> I'd be inclined to adopt a "decorator" pattern on this to get your security
> to work.
>
> Basically have an inner implementation of your methods without security and
> then an outer, publicly exposed class that only have security and have it
> defer to the inner class to do the work.
>
> Sort of like this:
>
> public class Repository
> {
> private RepositoryImpl Inner = new RepositoryImpl();
>
> public Customer GetCustomer(int customerId)
> {
> RequireOrThrow(JobRole.site_data_entry, "You do
> not have permission to access this customer.");
> return this.Inner.GetCustomer(customerId);
> }
> }
>
> internal class RepositoryImpl
> {
> public Customer GetCustomer(int customerId)
> {
> //Do stuff to get customer - no security code
> }
> }
>
> I've over simplified it, but how does that sound?
>
> Cheers.
>
> James.
>
> -Original Message-
> From: ozdotnet-boun...@ozdotnet.com [mailto:ozdotnet-boun...@ozdotnet.com] On
> Behalf Of Stephen Price
> Sent: Friday, 20 May 2011 16:59
> To: ozDotNet
> Subject: clever friday code
>
> Hey all,
>
> I'm looking for a way to get at the value of the parameter of a method
> call from a custom attribute.
>
> [RequiresJobRole(JobRole.site_data_entry)]
> public void GetPerson(int personId)
> {
> // Do stuff if authorised
> }
>
> Then in the attribute
>
> protected override AuthorizationResult IsAuthorized(IPrincipal
> principal, AuthorizationContext authorizationContext)
> {
> // For inserts and updates I can check the Entity being
> operated on via something like this
> var person = authorizationContext.Instance as PersonalDetails;
>
> // But its null if I'm doing a Query / read.
>
> var hasPermission = // getThe int personId that the method
> was called with and check they have access. Is this even possible?
> if (hasPermission)
> {
> return AuthorizationResult.Allowed;
> }
> return new AuthorizationResult("You do not have permission
> to access this person.");
> }
>
> I can do this with Inserts, Updates and Deletes. Calling a method to
> do a view or query seems impossible. How do I know what they are
> trying to view? user permission is based on the Id of the item they
> are looking up. There's a stored proc that goes off and returns their
> permission mask on the items they are accessing. Problem is I can't
> tell what they are trying to view.
> The other solution is to put a user validation call at the top of each
> method like so;
>
> public void GetPerson(int personId)
> {
> if(UserHasAccess()){
> // Do stuff if authorised
> }
> else{
> throw new SecurityAccessException("go away");
> }
> }
>
> but a single Attribute on the method would be cleaner. Otherwise have
> to put that code all over the place...
>
> cheers,
> Stephen
>
Re: clever friday code
Hi Steven,
There are already an Attribute within the .net framework that are used to
enforce permissions..
Try the PrincipalPermissionAttribute..
http://msdn.microsoft.com/en-us/library/system.security.permissions.principalpermissionattribute.aspx
You could maybe use Reflector or other similar tool to see how it's done in
this class, so you can implement yours.
Grant
On Fri, May 20, 2011 at 5:29 PM, Stephen Price wrote:
> Hey all,
>
> I'm looking for a way to get at the value of the parameter of a method
> call from a custom attribute.
>
> [RequiresJobRole(JobRole.site_data_entry)]
>public void GetPerson(int personId)
>{
>// Do stuff if authorised
>}
>
> Then in the attribute
>
> protected override AuthorizationResult IsAuthorized(IPrincipal
> principal, AuthorizationContext authorizationContext)
>{
> // For inserts and updates I can check the Entity being
> operated on via something like this
>var person = authorizationContext.Instance as PersonalDetails;
>
> // But its null if I'm doing a Query / read.
>
> var hasPermission = // getThe int personId that the method
> was called with and check they have access. Is this even possible?
> if (hasPermission)
>{
>return AuthorizationResult.Allowed;
>}
>return new AuthorizationResult("You do not have permission
> to access this person.");
> }
>
> I can do this with Inserts, Updates and Deletes. Calling a method to
> do a view or query seems impossible. How do I know what they are
> trying to view? user permission is based on the Id of the item they
> are looking up. There's a stored proc that goes off and returns their
> permission mask on the items they are accessing. Problem is I can't
> tell what they are trying to view.
> The other solution is to put a user validation call at the top of each
> method like so;
>
>public void GetPerson(int personId)
>{
> if(UserHasAccess()){
>// Do stuff if authorised
>}
> else{
>throw new SecurityAccessException("go away");
> }
>}
>
> but a single Attribute on the method would be cleaner. Otherwise have
> to put that code all over the place...
>
> cheers,
> Stephen
>
