Security Using MVC Activity-based Authorization

Role-based Security Model

Role-based security models create a user and role and also link said users to roles... and that is it. This is very straightforward and fits perfectly for some applications. The problem with this approach is the limitation of extendibility since it is very hard to maintain as the application grows and roles are added overtime.

Operation-based security models creates users, roles and operations (activities) that enable a user to be linked to one or more roles -- and roles to be linked to one or more operations. I find this model suitable for many applications -- small or large -- and a variety of scenarios. Since this is my model of choice, I'll explain it in the rest of this post.

The requirement has to create a security model that allows users to conduct some, but not all of, the admin functions.

1. Create a user object that encapsulates all roles and activities that look like the one below. You can customize it to fit your business needs

public class User
{
public string Name { get; set; }
public string AuthenticationType { get; set; }
public string EmailAddress { get; set; }
public bool IsAuthenticated { get; set; }
public string UserName { get; set; }
public List<string> Roles { get; set; }
public List<string> Activities { get; set; }

}

This class can be expanded to hold a collection for Role and Activity objects but, for the sake of simplicity, I am using a list of roles and activities. Let’s assume we have a repository that will give us a user object as it shows in this example:

public User GetUser(string p)
{
return new User()
{
Activities = new List<string>("Submit".Split(',').Select(s => s)),
AuthenticationType = "Windows",
Name = "Test",
Roles = new List<string>("User,Submitter".Split(',').Select(s => s)),
IsAuthenticated = true
};
}

2. We have the user object and need to pass the Identity object for the user principal. So we will need to create a custom Identity that implements IIIdentity and a custom Principal that implements IPrincipal.

public class CustomIdentity : IIdentity
{
Security.User _user;
public CustomIdentity(Security.User User)
{
this._user = User;
}
public string AuthenticationType
{
get { return _user.AuthenticationType; }
}
public bool IsAuthenticated
{
get { return this._user.IsAuthenticated; }
}
public string Name
{
get { return this._user.Name; }
}
public List<string> Roles
{
get { return this._user.Roles; }
}
public List<string> Activities
{
get { return this._user.Activities; }
}
}

public class CustomPrincipal : IPrincipal
{

private CustomIdentity _identity;
public CustomPrincipal(CustomIdentity identity)
{
this._identity = identity;
}
public IIdentity Identity
{
get { return _identity; }
}
public bool IsInRole(string role)
{
// convert comma delimited list to an array
List<string> givenRole = new List<string>();
givenRole = new List<string>(role.Split(',').Select(s=>s));
foreach (var r in _identity.Roles)
{
foreach (var ir in givenRole)
{
if (r.ToUpper() == ir.ToUpper())
{
return true;
}
}
}
return false;
}
public bool IsInActivity(string activity)
{
// convert comma delimited list to an array
List<string> givenActivity = new List<string>();
givenActivity = new List<string>(activity.Split(',').Select(s => s));
foreach (var r in _identity.Activities)
{
foreach (var ia in givenActivity)
{
if (r.ToUpper() == ia.ToUpper())
{
return true;
}
}
}
return false;
}

public bool hasRoleActivity (string role, string activity)
{
bool hasRole = false;
bool hasActivity = false;
foreach (var r in _identity.Roles)
{
if (r.ToUpper() == role.ToUpper())
{
hasRole = true;
}
}
foreach (var a in _identity.Activities)
{
if (a.ToUpper() == activity.ToUpper())
{
hasActivity= true;
}
}
return hasActivity && hasRole;
}
}

Notice the CustomPrincipal object provides a way to check if the user has roles or activities or both. This behavior will make our lives a lot easier when we have a situation where a user has to be in a role with a certain type of permission to conduct an action.

var principle = httpContext.User as CustomPrincipal;
if (principle == null || principle.Identity == null || !principle.Identity.IsAuthenticated)
return false;
if (!string.IsNullOrEmpty(Roles) && string.IsNullOrEmpty(Activities))
{
return principle.IsInRole(Roles);
}
if (string.IsNullOrEmpty(Roles) && !string.IsNullOrEmpty(Activities))
{
return principle.IsInActivity(Activities);
}
if (!string.IsNullOrEmpty(Roles) && !string.IsNullOrEmpty(Activities))
{
return principle.hasRoleActivity(Roles, Activities);
}
return false;
}
}

This custom authorize attribute we just created can be used to pass it either roles or activities or both as we will see in the example below.

5. We have everything ready for our application and we just need to wire the controllers/Actions with whatever role/activity needed. I have created three controllers and tagged them with the custom authorize attribute as follows:

[Security.CustomAuthorize(Roles="Admin")]
public class AdminController : Controller
{}
[CustomAuthorize(Roles="User")]
public class HomeController : Controller
{}