Authentication using principals

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

roundcrisis - 20 Aug 2007 17:15 GMT

Hi there:

I have seen some examples of authentication using principals, this is
for an intranet so a somewhat low level of security is required,
however I woudl like to know the disadvantages of using principals.
Also when I generate the identity for my principal, I use
GenericIdentity, is this ok? is there any obvious reason not to use
this on a production ?

thanks

Reply to this Message

Nicholas Paldino [.NET/C# MVP] - 20 Aug 2007 17:31 GMT

I don't think there are many (if any that I can think of) disadvanges to
using principals. I rather like the model. You can use GenericPrincipal if
you want, but it might be better to create a class that implements
IPrincipal or use an exising IPrincipal implementation which would suit your
needs more. The reason for this is that you have no way of assigning roles
to a user with the GenericPrincipal class. It's identifying the users in
those roles which makes authorization in .NET work.

How are you identifying and authorizing the users? Answering that
question will help determine which IPrincipal implementation you should use.

Signature

- Nicholas Paldino [.NET/C# MVP]
- mvp@spam.guard.caspershouse.com

> Hi there:
>
[quoted text clipped - 6 lines]
>
> thanks

Reply to this Message

roundcrisis - 21 Aug 2007 08:56 GMT

hi:

Thanks for your answer, I ander below

> I don't think there are many (if any that I can think of) disadvanges to
> using principals. I rather like the model. You can use GenericPrincipal if
> you want, but it might be better to create a class that implements
> IPrincipal or use an exising IPrincipal implementation which would suit your
> needs more.

well i m using a class that implements Iprincipal but to actually
generate the identity i use genericIdentity
I m not using roles at the moment, so i initialize the class with new
string[0] = "default"; which really doesnt convince me
I might have to add roles in the near fututre, any suggestions?

The reason for this is that you have no way of assigning roles

> to a user with the GenericPrincipal class. It's identifying the users in
> those roles which makes authorization in .NET work.
>
> How are you identifying and authorizing the users? Answering that
> question will help determine which IPrincipal implementation you should use.

I use another existing class to do the actual validation and then
generate the principal, but this is something that works, however I m
not convinced of the actual
correctnes of the implementation,

> --
> - Nicholas Paldino [.NET/C# MVP]
[quoted text clipped - 12 lines]
>
> - Show quoted text -

Reply to this Message

roundcrisis - 22 Aug 2007 08:57 GMT

> hi:
>
[quoted text clipped - 50 lines]
>
> - Show quoted text -

Reply to this Message

Authentication using principals

Free Magazines