Namespace: System.Security.Principal
Authenticating is the process of checking a user’s identity.
Authorization means verifying user’s right to access the resources according to
his identity.
Usually authorization happens after
authentication.
Integrate system with Active Directory using WindowsIdentity and WindowsPrincipal.
For straight-forward database, use GenericIdentity
and GenericPrincipal.
For a better control over user and roles implement IIdentity and IPrinciapl.
WindowsIdentity Class:
This class represents a windows
account, along with user name and authentication code. Instance of
WindowsIdentity can be created using:
1.
GetAnonymous:
Returns WindowsIdentity Object of an unauthenticated user, which is used to
insure that your code runs successfully.
2.
GetCurrent:
Returns WindowsIdentity that represents the current logged in user.
3.
Impersonate: Returns a WindowsImpersonationContect Object
used prior to authenticating user from the
WindowsPrincipal Class:
This class provides facility to work
with the membership of the user in different groups.
WindowsBuiltinRole enumeration
enlists three major groups which are Administrator, Power user and simple user.
WindowsPrincipal.IsInRole(“ikonami/mubbasher”)
can be useful.
PrincipalPermissions class:
This class allows acquiring certain permissions related like
membership to a role to execute a code.
Authenticated, Role and Name are major properties related to it.
[PrincipalPermission(SecurityAction.Demand,
Role = @“BUILTIN \Administrators”)]
[PrincipalPermission(SecurityAction.Demand,
name = @“ikonami\mubbasher”)]
[PrincipalPermission(SecurityAction.Demand,
name = @“ikonami\mubbasher” , Role = @“ikonami\developers”)]
[PrincipalPermission(SecurityAction.Demand,
Authenticated= true)]
Or use imperative style…
PrincipalPermission p = new
PrincipalPermissions(PermissionState);
//PermissionState can be None or Unrestricted
PrincipalPermission p = new
PrincipalPermissions(name, role);
PrincipalPermission p = new
PrincipalPermissions(name, role, authenticated);
p.Demand ();
Any of the name, role, Authenticated can be null.
Implementing Custom Users and Roles
Implement Custom Identity Class by implementing IIdentity interface.
Interface contains the following properties: AuthenticationType(NTLM, Kerberos, and Passport), IsAutehnticated and Name
Implement Custom Principal Class by implementing IPrincipal interface.
IPrincipal interface contains the following Property Identity and method
IsInRole.
Creating Simple Custom User Privilege Model:
This Model is based on GenericIdentity
and GenericPrincipla.
GenericIdentity MyIdentity = new
GenericIdentity("MyIdentity");
// Create generic principal.
String[] MyStringArray =
{"Manager", "Administrator"};
GenericPrincipal MyPrincipal =
new GenericPrincipal(MyIdentity, MyStringArray);
Thread.CurrentPrincipal =
MyPrincipal;
OnlyAdministratorMethod();
And OnlyAdministratorMethod() is:
[PrincipalPermission(SecurityAction.Demand,
Role= “Administrators”)]
Public void
OnlyAdministratorMethod()
{
}
Exception Handling
System.Security.Authentication.AuthenticationException occurs
when credentials are invalid, prompt from the user and try again.
System.Security.Authentication.InvalidCredentialException
underlying stream is in invalid, so don’t try again.
These exception usually occur when you authenticate remote
users based on underlying streams System.Net.Security.NegotiateStream or
System.Net.Security.SslStream
Comments