Is Windows Authorization Manager (AzMan) Obsolete? Is it good to use in a new ASP.NET application?

Question

Does anyone use Windows Authorization Manager (AzMan) anymore for "greenfield" projects? If so, are there any benefits to using the technology in an ASP.NET application as a membership/role provider?

Answer 1

The answer appears to be no. No one has answered this question, and a blog question posted in 2004 along with some more recent comments appear to convey mostly negative experiences folks have had. NetSqlAzMan would be worth investigating.

http://weblogs.asp.net/lorenh/archive/2004/02/24/79218.aspx

Some choice comments from the link:

1.

Udi Dahan - The Software Simplist said: Saw it at a local .Net user group some time ago. Seemed nice, except for the interop.

One other thing is the ability to perform "business tasks" that are really only script.

Should the interop go away, and be able to call .Net code for business tasks, this would truly be a killer.

2.

Chris Bilson said: We have it fully integrated into our ASP.NET application. The Interop part really sucks when you have defined alot of operations and are doing lots of authorization checks. It's a real performance killer.

I have my own wrapper class that invokes my "Business Tasks" when an access check is performed.

I feel kind of frustrated that there isn't more information about this tool, as I agree that it is nice way to get out of hard coding role checks into my application - something that would not be acceptable in my case due to varying customer defintions of what a "Manager" is and what they can do.

3.

Dominick Baier said: hi,

i love azman! i have written some stuff on it on www.leastprivilege.com - especially that ability to use non-windows accounts is very cool!

dominick

4.

Mathertel said: Yes, we use it in a .NET Web Application, built a wrapper and a bunch of additional tools to work with (a lot of tools are missing in the MMC snapin)

5.

Tom Bruns said: I have used AzMan extensively in a large .NET Web application. I think that the conceptual model is very good. However, there is alot of "lessons learned" concerning how to correctly architect the application to use it relative to performance, ongoing maintaince of the policy store, interaction with ADAM etc. If I can be of any help please feel free to email me. Replace nospam with com in my email address. Used correctly it can perform very well.

6.

Horea Hopartean said: We tried to use it and keep its repository on a Win2003 AD, but at 10000 users it took 13 (thirteen) seconds to do an OpenApplication call.

That and the ugly API may be good reasons why it hasn't got any traction so far :)

7.

news75 said: Hi, I have the same problem.

I'm comparing Visual Guard, AzMan, NetSqlAzMan and the feature provided from the framework .net 3.0.

At the moment I'm prefering NetSqlAzMan. It's well integrated with .net framework, the comunity is active, is Open Source. Yes there are some limitation: Only Window or custum Authentication and Microsoft SQLManager, but...

I'm wondering: why this argument is so underestimates!?

8.

Riverway said: I am developing an Enterprise RBAC system using Azman with AD store. To overcome the slow performance, I wrote a wrapper class which access directly Azman in AD's OU structure using LDAP query. Another thing to mention is that Azman of Windows Server 2008 version has capability to create data store in SQL2008 database. My biggest complain is that Security Dialog for any resources (folders, disks, etc) does not recognize Azman defined groups or roles as available identity. This makes really difficult to integrate RBAC which encompass ERP and other enterprise roles AND Windows Resource Access Control at the same time unless you write an application which can write on AD directly.

9.

James said: We used azman on our project and it sucks. We've had a ton of problems with interoperability, and it didn't work for our developers using Win7 when the .xml file was made on a win2003 machine. We even went as far as reporting a bug to Microsoft. It does a ton of COM BS like randomly not working and saying E_INVALIDARG, whatever that means. This is one of the technologies I want to remove from our project when I get a chance.