How To? Highly Complex Query Generating Based On Security Needs

In case you haven't seen Rhino.Security

ayende.com/.../Rhino-Security-Overview-Part-I.aspx

I am not sure if can do exactly what you want, but it is worth looking.

Thank you for submitting this cool story - Trackback from DotNetShoutout

We have similar complexity in parts of our system, like only retail members can see these items but everyone can see these other items.

I used Rhino security and put it in a separate bounded context. Rhino security can attach security criteria to any query. It also has the ability to relate permissions to a specific entity. So I created a set of security listeners that represent my security rules. The listeners listen to appropriate events and apply the needed security rules. Example for Rule #4. I would create listeners for the following events: Veteran added to region, veteran removed from region, Counselor added to Regional Office, and Counselor removed from regional office. When any of these events occurs the listener will add/remove the appropriate permissions for the Counselor/Veteran pair. Rhino Security handles everything else.

Exactly. Rhino Security Permissions have three "dimensions" : User/User Groups, Operations (which are hierarchal), and optionally Entities/Entity Groups.

This allows us to break any security rule down into a simple "this user/group either can or cannot perform these operations on this entity/entity group". Rhino Security handles the aggregation of permissions (eg  a user is a member of a group but also has its own permissions for an operation) automatically.

Trust me once you implement Rhino Security you will never look back and you will wonder how you ever managed with only Asp.Net's role system before.

+1 to Rhino Security.  The really cool part is how it transparently attaches to your domain then applies the necessary nhibernate detached criteria so filtering can happen in the query at the db level.  No more client side filtering and applying rules on huge result sets!

I wonder if you can take advantage of NHibernate Filters here and attach a security to the session at runtime to get let NH do the heavy lifting for you.

Might be simpler if this is the only place in your app you have encountered this

Pingback from  Arjan’s World    » LINKBLOG for June 26, 2009

What about just building a set of composable methods that expose IQueryable<T> and then building up a query based on the current context's security concerns.  As you chain these methods together the query gets more and more limiting.  It's not a very "slick" way of doing it but the composability of IQueryable is extremely powerful.

You might consider using a collection of specification patterns (Evans).  

Given the fact that you need to see the difference between "not-authorized" and  "does not exist", you may want to pull the releveant records for a vet even if the Conselor can't have access to the record.  

Then, you can run the results through a Specification rule, or a series of them, to determine if the conselor has access to the particular record.  

If not data is returned from the query, you know the record does not exist.  If a record IS returned, but the combination of the conselor and the vet fail the specification rule, you can return "not-authorized."

Here's a link to a specification implementation using generics.  I found it helpful and modified it to accept two objects.  You could pass in your conselor and the vet dto's.  

devlicio.us/.../the-specification-pattern.aspx

This may or may not work from a performance standpoint depending upon how many records are being returned/evaluated.  

For Rhino Security

1.Where and how in the app life cycle(at which layer )  , do we "set" the

security keys for the entities ?

n does setting the security keys for entities inserts a record in the

EntityReferences (security) table ??

2.How do u bind entities from application domain (or application

tables ) with the rhino security using IInformation Extractor ? and

how and in which table of the rhino schema, these links shown.Permissions are to be added for entities as

enity group using permissions builder service using two overloads

.On(EntityGroup) and  .On<Entity>(Entity)

3.Please provide more documenation on the usage n implementation of

security tables :

a) Entity References (security)

b) EntityReferencesToEntityGroups

c) Use of "Oneverything"