DevForce Community Forum : User privileges http://www.ideablade.com/forum/ This is an XML content feed of; DevForce Community Forum : Community Forum : User privileges Mon, 20 Apr 2026 13:54:57 -700 Tue, 08 May 2012 19:39:09 -700 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 9.69 360 www.ideablade.com/forum/RSS_post_feed.asp?TID=3432 DevForce Community Forum http://www.ideablade.com/forum/forum_images/IdeaBlade_logo_tm.png http://www.ideablade.com/forum/ User privileges : Silverlight is more useful ... http://www.ideablade.com/forum/forum_posts.asp?TID=3432&PID=13546#13546 Author: giotis
Subject: 3432
Posted: 08-May-2012 at 7:39pm

Silverlight is more useful]]> Tue, 08 May 2012 19:39:09 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=3432&PID=13546#13546 User privileges : Agreed. Cocktail currently has... http://www.ideablade.com/forum/forum_posts.asp?TID=3432&PID=13545#13545 Author: mgood
Subject: 3432
Posted: 08-May-2012 at 7:04pm

Agreed. Cocktail currently has the building blocks to do this, but it doesn't have a configurable module manager. Perhaps that is something that could be added in the future. Are you doing WPF or Silverlight?]]> Tue, 08 May 2012 19:04:11 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=3432&PID=13545#13545 User privileges : Thank you for your immediate responseI... http://www.ideablade.com/forum/forum_posts.asp?TID=3432&PID=13544#13544 Author: giotis
Subject: 3432
Posted: 08-May-2012 at 6:34pm

Thank you for your immediate response

I agree with what you said
but it is true if the application have fifteen Assembly and the user is authorized only for the five the application loads all ?
many times the functionality and cosmetics go together

Anyway I'll wait a little help because should spend the rest of my life to do it
Thanks again
]]> Tue, 08 May 2012 18:34:06 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=3432&PID=13544#13544 User privileges : To secure an application, you... http://www.ideablade.com/forum/forum_posts.asp?TID=3432&PID=13542#13542 Author: mgood
Subject: 3432
Posted: 08-May-2012 at 4:55pm

To secure an application, you should start with securing your domain model. An application that simply hides stuff on the UI based on the user's permissions is not a secure application if the data model is left wide open. This is called security through obscurity. True security starts at the server and the domain model. DevForce has a flexible authorization model to secure your back-end. See the following link as a start.

http://drc.ideablade.com/xwiki/bin/view/Documentation/authorize

Once your domain model is properly secured, you automatically get error messages if a user tries to do something that they don't have permission to. If you look at the latest TempHire code you see the beginnings of how to secure a data model. In TempHire you have to to be an authenticated user before you can save or query. This is accomplished through the RequiresAuthenticationAttribute on EntityBase, from which each entity in the domain model extends. It doesn't do anything with roles or specific permissions yet. 

    [ProvideEntityAspect]    [DataContract(IsReference = true)]    [RequiresAuthentication]    public abstract class EntityBase    {        private EntityFacts _entityFacts;         [NotMapped]        public EntityFacts EntityFacts        {            get { return _entityFacts ?? (_entityFacts = new EntityFacts(this)); }        }         [DataMember]        [ConcurrencyCheck]        [ConcurrencyStrategy(ConcurrencyStrategy.AutoIncrement)]        public int RowVersion { get; internal set; }         public virtual void Validate(VerifierResultCollection validationErrors)        {        }    }

Once you have your domain model secured, the rest is cosmetics on the UI. Disabling buttons if the user doesn't have permission can easily be done by adding corresponding CanXXX properties for your actions in the VM so that the buttons are disabled or you can bind the visibility attribute so that the controls are not visible if the user doesn't have permission. 

To hide entire ViewModels many developers leverage MEF metadata to control which exports should be visible to the current user. You can learn more about Exports and metadata in MEF here: http://mef.codeplex.com/wikipage?title=Exports%20and%20Metadata&referringTitle=Guide


Edited by mgood - 08-May-2012 at 4:58pm]]> Tue, 08 May 2012 16:55:27 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=3432&PID=13542#13542 User privileges : If assuming that each user has... http://www.ideablade.com/forum/forum_posts.asp?TID=3432&PID=13541#13541 Author: giotis
Subject: 3432
Posted: 08-May-2012 at 4:13pm

If assuming that each user has these privileges

Users

Add

Edit

Delete

Read

Database

Supervisor

x

x

x

x

TempHire, Security

Admin

x

x

x

x

TempHire

User

x

 

 

x

TempHire


at first level

            and we had many Module where each of them to defined different privileges

           depending on the user loads the appropriate Module

second level

           depending on the user to allow for appropriate actions

           1.disable ViewModel

           2.disable actions

           3.or error messages


is easy to embed them in Cocktail?

         



]]> Tue, 08 May 2012 16:13:57 -700 http://www.ideablade.com/forum/forum_posts.asp?TID=3432&PID=13541#13541