Books / Resources on Authentication and Authorization in Multilevel Applications

Question

I'm trying to find resources and guidelines for implementing authentication and authorization in layered architectures (C #), but have not found "best practices" or patterns to use. And I thought that there should be some patterns for this, since this is a pretty important area?

The application we are developing traditionally overlays layers, having

• data layer (Entity Framework 4)
• repositories
• domain level
• service level (may be WCF, with data transfer objects)
• several clients consuming the WCF service (ASP.NET [MVC], Silverlight, WPF) and clients accessing the service level directly (without WCF)

Are there books / articles / blogs in this area? First of all, about authorization, for example, processing several roles and attributes attached to users).

It should not be specific to the .NET Framework, but would be preferable.

---

UPDATE: I already have good links, but I'm looking for examples and implementation examples. Maybe a solution that implements something like the above?

Answer 1

These resources may be useful.

http://msdn.microsoft.com/en-us/security/aa570351.aspx from Microsoft, mainly about the Windows Identity Foundation

Claims-based identity and access control guide from the Microsoft Patterns & Practices team

Best wishes

Answer 2

Yes, you can check the templates and methods. Application Architecture Guide 2.0

This will give you design-level guidance for architecture and application design. It’s also good that it is specific to .NET :)

Answer 3

Some links to check.
Common Security Scenarios
patterns and methods: WCF Security Guide
patterns and methods Improving Web Services Security Guide
Security Considerations (Entity Framework)