How to integrate access control with my ORM in a .net windows form application?

Question

I am developing a general database query tools, a .Net 3.5 Windows Form application. In order to make the presentation layer is independent of the database layer. I use an ORM framework, XPO from DevExpress.

But, I have no access control function built in. I surfed Internet and I found in WCF Data Services, there is an interesting concept, Interceptor, which is following AOP(Aspect Oriented Programming).

I am wondering who has such an experience to build access control in ORM. My basic requirement is :

1. It should be a general method and controlled by users in runtime. So any hard coding is not acceptable.
2. It could be based on attribute, database table, or even an external assembly.

I am willing to buy a ready solution. According to the idea of AOP, an access control function can be integrated with existing functions easily and nearly not knowingly to the previous developer;)

Any suggestions are welcome.

Answer 1

I'm not sure that this answer will be helpful in your situation, but it can be interesting for you.

X-tensive company (developer of DataObjects.Net ORM) plans to implement similar feature for DataObjects.Net in few months. X-tensive's plan is to provide full featured ready to use security extension, possibly based on attributes and aspects. Surely it will be closely connected with this ORM, but you can derive some ideas from its description. See feature request and its discussion here.

You can also take a look at Rhino Security, I don't know current status of this project, but it seams such solution can be useful in your case.