WPF permission-based authorization

Question

I've been doing C# for a month now so please forgive the 'localness' to this question but I have researched for a couple hours and I have hit a brick wall.

I've seen examples left and right for Role-based authorization for WPF applications utilizing IIdentity and IPrincipal.

I can't find a lot of information, however, on a more Permission-based authorization approach, in this app imagine there are no Groups but just a list of permissions and users and you can assign anyone any permission.

I'd like to be able to:

1. Be able to control the UI/elements based on user permissions with such states as: Enabled, ReadOnly, Invisible, Collapsed (as seen here https://uiauth.codeplex.com/)
2. Be able to specify at the class or method level which permissions are required (similar to http://lostechies.com/derickbailey/2011/05/24/dont-do-role-based-authorization-checks-do-activity-based-checks/)

Instead of:

[PrincipalPermission(SecurityAction.Demand, Role = "Administrators")]

I want something like:

[PrincipalPermission(SecurityAction.Demand, Permission = "Can add users")]

Right now the only way I see how to do this is utilizing ICommand and putting authorization logic in the CanExecute methods using a lot of string comparison to see if the user has the required rights to perform requested actions like:

// Employee class
public bool HasRight(SecurityRight right)
{
    return employee.Permissions.Contains(right);
}

// Implementation, check if employee has right to continue
if (employee.HasRight(db.SecurityRights.Single(sr => sr.Description == "Can edit users")))
{
    // Allowed to perform action
}
else
{
    // User does not have right to continue
    throw SecurityException;
}

---

I think I understand enum/flag/bits but not enough to complete the implementation...

If I have:

EmployeeModel
EmployeeViewModel

I'm not sure where everything goes and how to tie it all together.... here's what I have so far:

    [Flags]
    public enum Permissions
    {
        None = 0,
        Create = 1 << 0,
        Read = 1 << 1,
        Update = 1 << 2,
        Delete = 1 << 3,

        User = 1 << 4,
        Group = 1 << 5
    }

    public static void testFlag()
    {
        Permissions p;
        var x = p.HasFlag(Permissions.Update) && p.HasFlag(Permissions.User);
        var desiredPermissions = Permissions.User | Permissions.Read | Permissions.Create;
        if (x & p == desiredPermissions)
        {
            //the user can be created and read by this operator
        }
    }

Answer 1

The reason why you're probably seeing lots of Role-based solutions is because that's a much more maintainable solution in the long run.

Rather than giving rights to individuals and having to manage each individual across an organization you can set up a handful of templates (roles) with different levels of authorization to an application's feature set.

Then you can just see whether a user is in that role or not as to whether he can do a certain action.

I know it doesn't help your question as directly as you probably want, but I would highly recommend using a similar solution.