Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>You need to two keep concepts apart:</p> <ul> <li><p><strong>AUTHENTICATION</strong> is the process of determining who it is that's calling you, and making sure he really is who he claims to be; this can be done using username/password, Windows credentials (he had already authenticated himself to his Windows box through logging on), or by requiring the caller to have some information (certificate)</p></li> <li><p><strong>AUTHORIZATION</strong> is the process - once you <strong>know</strong> who is calling you, to determine what that caller can do (or what he cannot do)</p></li> </ul> <p>In order to use Active Directory groups, you need to use a security mode in WCF that supports Windows credentials. The easiest is to use Windows credentials from the beginning, which is the default for wsHttpBinding and netTcpBinding - in this case, the caller will always pass along his Windows credentials with every call, and you can inspect those on the server side by looking at the <code>ServiceSecurityContext.Current.WindowsIdentity</code>:</p> <pre><code>WindowsIdentity caller = ServiceSecurityContext.Current.WindowsIdentity; </code></pre> <p>This works well in an Intranet scenario - everyone is behind a corporate firewall and authenticated on their machines anyway. In order to enable this, just use wsHttp or netTcp binding (I'd recommend netTcp in this case).</p> <p>The other slightly more complicated case is when you have your client present a X.509 certificate, and you then map that on the server side to an existing AD user in your network. That's rather advanced, however.</p> <p>Once your caller is authenticated, e.g. you know who is calling, you can use the regular role-based security model to limit privileges. Just add <code>[PrincipalPermission(....)]</code> attributes to your methods that you want to protect, and if the user doesn't match any of those requirements, a security exception will the thrown and the method will not be executed. </p> <pre><code> [PrincipalPermission(SecurityAction.Demand, Role = "Administrators")] [PrincipalPermission(SecurityAction.Demand, Name = "JohnDoe")] public string SayHello(string caller) { ...... } </code></pre> <p>You can have multiple of those "PrincipalPermission" attributes, and they're matched together in an "OR"-fashion - if any one of them matches the current caller, he'll be allowed to make the call.</p> <p>Check out page 4 of this article <a href="http://www.code-magazine.com/article.aspx?quickid=0611051&amp;page=4" rel="noreferrer">Fundamentals of WCF Security</a> for more details on how to use role-based security.</p> <p>Marc</p>
    singulars
    1. This table or related slice is empty.
    1. POWCF Web Service Authentication based on AD groups
      singulars
      1. PTQuestion
    1. PTAnswer
    1. This table or related slice is empty.
    1. USmarc_s
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COThanks arc, Let me try your proposed solution. Many Thanks again.
      singulars
      1. PO
      1. USLalit Sharma
    2. COThis is great, thanks. Solved me a lot of work. How do you catch the SecurityException that is thrown, however? It seems to be thrown before the method is called but doesn't get propagated up the callstack...
      singulars
      1. PO
      1. UStrendl
    3. COIt's thrown to the client - the client needs to deal with that.
      singulars
      1. PO
      1. USmarc_s
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload