Authorization permission and .Net rights, as before in AzMan

Question

What is the best way to get permission to use and access rights in .Net. Previously, AzMan was used as a standard method. With the advent of the provider model, at least the roles are taken care of, but I'm not sure about the permission and the right. I am considering defining and accessing performance level permissions for roles / users. What is the most suitable way to achieve the above?

Answer 1

According to this API blog post, ClaimsAuthorizationManager is the next generation of AzMan. This is just an API, but it does not come with a default implementation or admin GUI, so it is not yet a direct replacement.

Answer 2

WIF / Geneva stuff still doesn't seem “mature” like AzMan. We have been using AzMan for about 3 years, and our implementation has evolved from a direct link to azman.dll to a WCF-based service that serves roles and operations. WCF WinForms Services, WPF Clients, and now I'm in the process of working with Silverlight. I don’t see that we will soon switch from AzMan, at least until an external interface for setting up WIF roles, operations, etc., which are provided for free in azman, is created ....

As for the details, we have our azman store in Active Directory and built DLL.net, which provides a .net wrapper around the ugly COM azroles.dll. In addition, we have a WCF service that basically just passes requests for roles and operations directly through dll.net azman. Roles and operations, etc. Returned as arrays of strings for client processing. There are two ways a service authenticates. Either through 1) anonymous authentication, or 2) Windows authentication (pass-thru). This means that if you provide a username and password, anonymous authentication will be used, which first uses these strings for authentication. If pass-thru / Windows Authentication is used, then the WCF service already knows that you are an authenticated Windows user ... There may be an argument for splitting anon and Windows authentication into two separate services ...

Typically, winforms and WPF clients use Windows authentication to go through and get available roles, while Silverlight clients use anonymous authentication ...