This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this).
Consider the following simple use case:
- I have a class User and a class Project,
- (for the sake of simplicity) each project has exactly one assigned User,
- The access control policy is that
A user can only read data of projects he is assigned to.
I am trying to model this using WIF and Claims-Based Authorization.
So I have the following method for which I want to check the access:
public Project ReadProject(int id)
To do this, I would have to make a call to the ClaimsAuthorizationManager with an AuthorizationContext containing the principal (=the user) and Claims for resources he wants to access and actions he want to perform on these resources.
What I am not clear on:
In the above use case, the permission is based on the fact
project.AssignedUserID == user.ID. What would the Claims look like?
- Is this requirement a Claim on the User/Principal, like "User has access project ID X", that I have to set before calling the ClaimsAuthorizationManager? If yes, at which point would I assign that Claim to the User? And would that not screw up the whole point of having centralized place to declare and check policies?
- Is it rather something that the ClaimsAuthorizationManager would check by looking up the database? If so, how would I translate the fact which project he wants to access into a Claim?
Most examples I find for CBA are based on attributes about the user (e.g. what country he is from), so I have no idea how to perform checks on the User-Data relation.