Quering PrincipalSecurityAttributes on class

[Pasi Häkkinen]

Hello,

I am applying PrincipalSecurityAttributes on class definition to force
role-based security on my ASP.NET pages. Is it somehow possible to query the
needed security roles for a certain page without maybe creating an instance
of that page class and check possible security exception? I'm providing
hyperlinks to these secured pages (and amongs them) and I would like to check
the permission to decide whether the hyperlink should be visible or not (..is
the logged-in user in correct roles or not)...

Or maybe there is a better approach to this problem altogether?

Thanks in advance,
Pasi

 

[[MSFT]]

Hello,

Did you mean "PrincipalPermissionAttribute"? All Attribute only work a
class instance was raise. We cannot detect the security exception without
create such a class.

I suggest you may consider some staff about exception handling about this
issue. For example, if a security exception was thrown, you can redirect to
a web form to let user know he doesn't has enough permission.

Luke

 

[Pasi Häkkinen]

Hello and thanks for your answer,

I sure meant "PrincipalPermissionAttribute", my mistake.. Our site is highly
customized by user roles, even for different signed-in users, and we want to
keep it as simple as possible for all the users. This is why we don't want to
confuse them with unnessary links that will end up on an error page. We do
have security exception handling function on these pages in case the user
will get through to such a page.

Surely we can check the security requirements separately for each hyperlink
using for example Page.User.IsInRole(...), but this adds the risk of coding
errors by possibly leading to unsyncronized security (link showing even
though no rights to see the page). It would be safe to check against
PrincipalPermissionAttribute and links would never go out of sync. Does this
make sense? Any other thoughts?

Regards,
Pasi

 

[[MSFT]]

Hi Pasi,

Did you need to check PrincipalPermissionAttribute from client side or
server side? From Client side, you have to submit a request to the page and
the web form class will be created. PrincipalPermissionAttribute is a
Attribute for class, we cannot detect its value without a class' instance.

Luke

 

[Pasi Häkkinen]

Hi Luke and thanks for your answer,

It is server side that I need... when building the page and it's links to be
sent to a client. So it seems we cannot read those attributes without
creating an instance... ok! I think I will go with a specific page
configuration file in xml-format that will have entry for each page and cache
that file for efficient use. Then I'll create a little PageConfiguration
class that can be initiated for a desired page. This class will then have
properties that reflect the page configuration file. That way I can extend
page properties any way I want and just ask PageConfiguration class a desired
property. Surely this will solve my problem of keeping the access rights in
one place and they will never go out of sync. And I can also use this config
file for other page specific configurations.

Thanks again for your effort,
Pasi

 

[[MSFT]]

Hi Pasi,

Thank you for the confirmation. I think your solution is a proper way to
get around the problem.

Luke

 

[Zdenek Drlik]

Hello,

I am applying PrincipalSecurityAttributes on class definition to force
role-based security on my ASP.NET pages. Is it somehow possible to query the
needed security roles for a certain page without maybe creating an instance
of that page class and check possible security exception? I'm providing
hyperlinks to these secured pages (and amongs them) and I would like to check
the permission to decide whether the hyperlink should be visible or not (..is
the logged-in user in correct roles or not)...

Or maybe there is a better approach to this problem altogether?

Thanks in advance,
Pasi

Hello,
I think you could get the attributes for page class with
TypeDescriptor.GetAttributes() method:

AttributeCollection attributes = TypeDescriptor.GetAttributes(type);

where type is page class type (page instance not required) and next
enumerate attributes:

IEnumerator enumerator = attributes.GetEnumerator();
while (enumerator.MoveNext())
{
Attribute currentAttribute = (Attribute) enumerator.Current;
if (currentAttribute is PrincipalPermissionAttribute)
{
PrincipalPermissionAttribute permissionAttribute = currentAttribute as
PrincipalPermissionAttribute;
// check for required, name apod.
string role = permissionAttribute.Role;
// ...
}
}

Zdenek D.