Need help improving authorization

[AndiV]

I don't have a response in framework.aspnet, may be this one is a more
appropriate group.

= = = = = = = = = = = = = = = = == = = = = = == = = = = = = = = = = = = = =
= = =

Each of my intranet page (windows authentication) needs to validate user's
roles stored in the database. Currently, I retrieve the the
User.Identity.Name property, then query the database for user's roles
everytime a page is loaded, which is very inefficient.

I think a more efficient approach would be to query the database only once
for each user, the application_start event is probably the best place? Once
this particular user's roles are retrieved, the roles can be concatenated as
a delimied string and stored in cookie or a session variable. Then on each
page load event, I just have to parse the roles string to apply
authorization.

I believe this scheme will work. But it seems more like a hack than a design
pattern or a best practice. I'm seeking a .NET elegant solution. Please
advise.

TIA,
Andi

 

[Joe Kaplan \(MVP - ADSI\)]

The basic ideas are that you want to cache the role data, either in a cookie
(which is what a lot of the forms auth samples show), Session or Cache.
With a cookie, you need to make sure you encrypt or use an HMAC to ensure
that the values are not tampered with.

All three approaches work fine and have their good points and bad points as
with any user state persistence requirement.

Joe K.

There are a few pages out there with methods for this, the one I used is

http://www.dotnet247.com/247reference/msgs/14/72098.aspx (you can find
vb.net and c# versions, although changing the code is not difficult).

 

[AndiV]

Thanks for your help, Shaun and Joe.