ASP.NET Security Roles AND Permissions

Question

I'm comfortable with the ASP.NET security model whereby one can allow/deny access to users in the web.config based on what roles they are in e.g.

<system.web>
  <authorization>
    <allow roles = "Admin" />
  </authorization>
</system.web>

However what I want to do is give the admin user a set of permissions which can then be checked e.g. an Admin user with permissions like "can print documents", "can delete document"

Is this sort of thing possible out of the box or would I need to go down a custom route?

Answer 1

You can use Azman as described in this MSDN article.

But there are a number of things I don't like about Azman, so I rolled my own as a complement to the RoleProvider (additional tables, APIs and admin tools that manage the mapping of permissions to roles).

My custom implementation is very simple:

• M-N relationship between roles and permissions.

• An API "HasPermission" that tests if a given principal has a given permission. This simply iterates through all roles and checks if the role has the given permission. The mapping permission-roles is cached using the ASP.NET cache for performance reasons.