[Policy("ServerPolicy")]

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

BenW - 04 Jul 2005 21:31 GMT

I see this attribute is applied at the class level. Is there a mechanism to
apply security policy at the method level to give a more granular way of
determining who has access to what methods.

I had a look through the samples and did not see this.

Any sample code or examples would be great.

Thanks in advance.

BenW

Reply to this Message

Hernan de Lahitte - 05 Jul 2005 02:07 GMT

The current tech preview of WSE 3.0 only has policy scope at the
class/endpoint level. If you need to specifiy different security
requirements for each web method, you might build a custom security
assertion. Perhaps a good example on how to do this may be the WS-I BSP
Sample Application
(http://msdn.microsoft.com/practices/default.aspx?pull=/library/en-us/dnpag2/html
/MSWSIBSP.asp)

If you look for the WSE 3.0 alpha version here:
http://practices.gotdotnet.com/workspace.aspx?id=0fecd2c7-b2b1-4d85-bd66-9d07a6ecbd86

You will find a custom assertion (customX509security) that handles this
issue.
Look for the requestAction attribute in the protection element of the
wse3policyCache.config file in
"Services\RetailerApplication\RetailerService\Configuration" folder.

Signature

Hernan de Lahitte
http://clariusconsulting.net/hdl

>I see this attribute is applied at the class level. Is there a mechanism
>to
[quoted text clipped - 8 lines]
>
> BenW

Reply to this Message

[Policy("ServerPolicy")]

Free Magazines