Re: Security - Permissions Configuration
From: Angelos Karantzalis (akarantzalis_at_agiltech.gr)
Date: 10/29/04
- Next message: Stephen: "Re: Writing arraylist items to the page"
- Previous message: Plamen Ignatov: "Re: .NET DEPLOYMNET"
- In reply to:(deleted message) UAError: "Re: Security - Permissions Configuration"
- Next in thread: UAError: "Re: Security - Permissions Configuration"
- Reply:(deleted message) UAError: "Re: Security - Permissions Configuration"
- Messages sorted by: [ date ] [ thread ]
Date: Fri, 29 Oct 2004 16:14:54 +0300
Yeah, I can understand that the wording is a bit messy & confusing.
In simple terms:
1. We have an application "base", where it provides some GIS-related UI
functionality ( It can do "stuff" on a Map, displayed in 2D or 3D ), and
some DB functionality & some messaging functionality ( All that will get
installed using an installer etc. etc. ).
2. We have several "applications" running on top of that, exploiting the
base services for the UI (Downloaded or installed from a CD).
3. We have "functionality libraries", implemented as Assemblies, doing ...
whatever. Those are the so-called "plugins", and the y operate on data
provided by the "application" that runs on top of the "base". In essence,
the plugins operate on data, and use the UI to show stuff exploiting the UI
services of the "base" ( Also downloaded or installed from a CD).
4. There is a single username/password for the complete package ("base",
"applications"), and users have/have not registered for use of various
"applications", and features ("plugins") per application.
5. Therefore, I might be able to use plugin A under application A, but not
under application B.
My "plugins" won't do anything that wouldn't run with the Internet
permission. They're just data-crunchers. I just need to restrict their usage
per application & user.
I hope I won't be re-inventing the wheel, that's why i took so much time
looking into the lists before I decide to write code, but ... at this point,
I think that that's the only way forward :] even if I do realise afterwards
that I'd duplicated framework functionality ... oh well ... at least I'll
have learned something, right ? :D
Thanx for all the help,
Angel
O:]
"UAError" <null@null.null> wrote in message
news:q2ivn0t9m24nmeo1um7ll12esae3mrq0ps@4ax.com...
> "Angelos Karantzalis" <akarantzalis@agiltech.gr> wrote:
>
> >.. I'll just have to do it myself then :D
> >
>
> You're still in the danger of reinventing the wheel and
> ,worse, creating yet another application that requires
> administrator privileges to run.
>
> >You're building an application, which supports services in the form of
> >dynamically downloaded plugins.
>
> OK standard users are often denied the privilege to
> "install" anything. A downloaded .NET assembly can be
> downloaded and run in a "sandbox" but it still is configured
> by CAS to the "Internet" Permission set and that doesn't
> allow much.
>
> You can however get the "client" too install code groups and
> permission sets that match your code through membership
> conditions to grant your assembly(ies) permissions beyond
> the ones found in the "Internet" permission set. However
> these must at least be present on the Enterprise level
> Security policy (marked as LevelFinal) which can only be
> done by an administrator. If its not marked as "LevelFinal",
> the code groups/permission sets will also have to be present
> on the User level Security Policy and Machine level Security
> Policy.
>
> But ultimately CAS cannot grant more rights than the user
> already has under Windows.
>
> >You can expect that more than one users will
> >be using the same installation. Some of those plugins though, need the
user
> >has special authorization (role) to run, others don't.
>
> This is were you are not specific enough - (A) does your
> application not want them to have access to an application
> feature or (B) is there a platform resource that the user
> does not have access too.
>
> if (A) then you need to implement you own RBS most likely
> with GenericIdentity and GenericPrincipal.
>
> if (B) let Windows Security handle it; .NET will generate an
> exception. If you want to be able to disable features in the
> absence of access rights use WindowsPrincipal.IsInRole - the
> Windows Group can be one you created on the machine or in
> the domain for the purposes of your application - existing
> users will then simply have to be assigned windows group
> memberships pertinent to your application.
>
> >To complicate the
> >matter a bit further, you can execute the plugin under a "login domain" -
> >you have multiple login domains in the app, and each time you try to do
> >anything, you do it under a login domain, a "context" if you will ... ,
>
> This is were you lose me - I think there's breakdown of
> communication here. To me a username that is valid in
> multiple network domains still are multiple distinct
> "users". I don't know what concept you are trying to convey
> with "login domains".
>
> However under windows it is possible for a windows user to
> run an application as a different user and have certain
> parts of the application run as a differrent user through
> the use of impersonation (provided the necessary credentials
> are present).
>
> But even that privilege can be denied. To impersonate you
> have to have the
> SeTcbPrivilege "Act as part of the operating system"
> (TCB = Trusted Computing Base)
>
> privilege. This has been changed in .NET Server 2003 which
> has:
> SeImpersonatePrivilege "Impersonate a client after
> authentication"
>
> to close that vulnerabilty.
>
> > and
> >the plugins are shared between domains. But you need different roles to
use
> >them under each domain ...
- Next message: Stephen: "Re: Writing arraylist items to the page"
- Previous message: Plamen Ignatov: "Re: .NET DEPLOYMNET"
- In reply to:(deleted message) UAError: "Re: Security - Permissions Configuration"
- Next in thread: UAError: "Re: Security - Permissions Configuration"
- Reply:(deleted message) UAError: "Re: Security - Permissions Configuration"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
