0

I’m currently building an ASP.NET MVC 5 EF6 blogging web application.

I have two databases and contexts :

-a database for the actual data of my application (blog posts, blog categories, tags, etc) .

-a database for authentification and membership purpose (users and roles).

I am able to authorize a given user the right to add/edit/delete blog posts, using the authorize attribute in the BlogPostcontroller : [Authorize(Roles=”Administrator,Author”)] and it works pretty well..

MY GOAL : let’s imagine I want to grant an user the right to add/edit/delete a subset of all the blog post or blog categories (let’s say only to the “Cooking” and “travel” blog categories).

I started to think about creating a navigation property between the user and the blog category entities, but apparently foreign keys between two separate databases are not supported by the entity framework.

Do you guys have an idea of a walk-around for this problem?

Your help will be much appreciated.

2
  • Could you add your users & roles to the application database, i.e. just have one connection?
    – markpsmith
    Apr 9, 2014 at 9:27
  • I would like to keep two separate databases for diverse maintainability, evolution and performance reasons. But I would end up doing as you say if I don't find a walk-arround...
    – JohnB88
    Apr 9, 2014 at 9:38

2 Answers 2

0

This is what you need. http://typecastexception.com/post/2014/02/19/ASPNET-MVC-5-Identity-Implementing-Group-Based-Permissions-Management-Part-I.aspx Basically, the privileges is what you will need to configure and associate user roles.

1
  • Thanks for you answer, but i don't think I need this. First it seems that they use a sole database. And they don't implement the user acces to the objet (subset) level, but in the class level.
    – JohnB88
    Apr 9, 2014 at 10:27
0

If you want to keep your authorization data separate from your business data, i.e. in 2 separate databases where one contains user information and permissions and the other contains your blog data, then what you actually want to achieve is externalized authorization. That's actually a great intent. After all, do you keep authentication information with your application data? Of course you don't.

Different frameworks give you externalized authorization capabilities. For instance, in .NET, you have claims-based authorization.

You can also take a generic approach and use XACML, the eXtensible Access Control Markup Language. XACML uses attributes (it's an attribute-based access control model as opposed to simply role-based) and combines them into policies & rules to define what can happen. For instance, with XACML, you can write the following rule: A user can edit blog posts he/she owns.

In XACML, you have the notion of an authorization engine called the Policy Decision Point (PDP). That PDP links together all the information it needs to make decisions. In your case, it will use the 2 separate databases and create the relationships on them.

Now, if your use case is simple, using XACML might prove too much. In that case, just use claims-based authorization.

1
  • Thanks David ! great input, will definitely have alook at your solution.
    – JohnB88
    Apr 10, 2014 at 6:37

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.