1

I am new to MVC .Net. I want to implement a RBAC system. I have certain actions/permissions that can be executed by certain members.

Is there a security framework that allows me to do this?

More Info

I am looking for something similar to a forum - a user has the ability to make a new post, reply to them, etc. A moderator, on the other hand, should have the permission to modify posts, ban users etc as well as those permissions provided to the normal users.

I read around that the .NET framework provides a membership table. I dont have too much knowledge about it, but from what I understood, it just groups users into certain membership. It does not have the concept of permissions.

Would I have to add another layer on top of the Membership table (would seem that I am re-inventing the wheel), or is there a framework that does this already.

4 Answers 4

2

You should take a look at Rhino Security - it allows you to define your own operations and apply permissions to specific groups/users/etc

http://ayende.com/blog/3109/rhino-security-overview-part-i

0

You could use Membership provider but it can be complicated to use and often times confusing. I'd start small and work your way up, Membership Provider is great for things like Single Sign On (SSO) where you have multiple apps but a single point of authentication.

Otherwise, use the AuthorizeAttribute in MVC. You can subclass it and create an extension of the attribute that does exactly what you need.

2
0

Read up on the Membership and Role providers. They are designed to handle your requirements.

The fundamental job of a role provider is to interface with data sources containing containing role data mapping users to roles, and to provide methods for creating roles, deleting roles, adding users to roles, and so on. The Microsoft .NET Framework's System.Web.Security namespace includes a class named RoleProvider that defines the basic characteristics of a role provider.

0

You can do simple permission based security using roles with the membership provider. You just define a role "Administrators" and then set permissions based on the role.

If you need more advanced permissions (such as allow-deny, etc..) then you will need to do more work.

But, you said you were looking for RBAC (Role Based Access Control) and asp.net has that built-in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.