Home/ Questions/Q 6575463
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T15:23:23+00:00

I am researching security frameworks for an ASP.NET MVC3 application that would have some

  • 0

I am researching security frameworks for an ASP.NET MVC3 application that would have some pretty complex authorization rules in terms who can see data, who can create and edit it. Rules such as
– I can only see clients that are part of my company or branch.
– If I am out 15 or less days from the day the record was created and my role is of super user then only I can edit all but two fields on that record. After 16 days or more I can only edit two fields.

My initial thought was to use the Enterprise Security Block and just add customized authorizers, but after reading more about the native support for membership based security in ASP.NET, I am not so sure if Enterprise Security Block is necessary. I have not use neither of the frameworks in a real-world application so looking for some collective wisdom on the topic.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is the problem with complex field level security. There is no real framework to help you with it, because everything is so custom. The best you can do is extract this into some kind of lookup table, and assign each field a custom identifier in the table, then have a set of columns that indicate each security level. Then, you build your business logic so that you pass in a field and conditions, and it simply responds back whether or not to allow it.

    THen you have to figure out what “allow” means in your interface. Disable it? Hide it? ignore it?

    I don’t envy you.

    You might find this semi-interesting.

    http://bartreyserhove.blogspot.com/2008/12/field-level-security-using-aspnet-mvc.html

    • 0