Ok, so I’m looking for a bit of architecture guidance, my team is getting a chance to re-cast certain decisions with a new feature that we’re building, and I wanted to see what SO thought 🙂 There are of course certain things that we’re not changing, so the solution would have to fit in this model. Namely, that we’ve got an ASP.NET application, which uses web services to allow users to perform actions on the system.
The problem comes in because, as with many systems, different users need access to different functions. Some roles have access to Y button, and others have access to Y and B button, while another still only has access to B. Most of the time that I see this, developers just put in a mish-mosh of if statements to deal with the UI state. My fear is that left unchecked, this will become an unmaintainable mess, because in addition to putting authorization logic in the GUI, it needs to be put in the web services (which are called via ajax) to ensure that only authorized users call certain methods.
so my question to you is, how can a system be designed to decrease the random ad-hoc if statements here and there that check for specific roles, which could be re-used in both GUI/webform code, and web service code.
Just for clarity, this is an ASP.NET web application, using webforms, and Script# for the AJAX functionality. Don’t let the script# throw you off of answering, it’s not fundamentally different than asp.net ajax 🙂
Moving from the traditional group, role, or operation-level permission, there is a push to ‘claims-based’ authorization, like what was delivered with WCF.
Zermatt is the codename for the Microsoft class-library that will help developers build claims-based applications on the server and client. Active Directory will become one of the STS an application would be able to authorize against concurrently with your own as well as other industry-standard servers…