I have a class library which contains my data base access layer, and i use it in all my projects which works with this DB, now i want to integrate security in this library so i can return different data for different security roles. What is the best way to achieve this with .NET build-in security? I was thinking about using System.Security.Permissions.PrincipalPermission but i can't see how it can help me out, because anyone using my library can write client application like this
GenericIdentity genericIdentity = new GenericIdentity("User");
GenericPrincipal genericPrincipal = new GenericPrincipal(genericIdentity, new[] { "Administrator" });
Thread.CurrentPrincipal = genericPrincipal;
And they will pass all my principal permission demands
PrincipalPermission principalPermission = new PrincipalPermission(null, "Administrator");
principalPermission.Demand();
without even authenticating. Either i don't understand this security model, or it just doesn't secure anything.