Use Authorization Manager (AzMan) For Managing Roles and Permissions

AzMan is an Access Control framework for defining operations to be grouped as a task; these operations in your application (that can be performed by the user). So using AzMan one can manage roles by providing permissions on various roles for various operations. Users are assigned various roles and based on those roles, permissions are granted to the user. AzMan also provides a management console known as Microsoft Management Console (MMC) for managing operations, roles, and permissions. One can configure the directory in Active Directory or in the form of XML. As I mentioned, it is a role-based framework, so the cost and effort to use it for application security is minimal and one of the interesting features is that it can directly work with the Active Directory, where AD groups can directly be configured for the specified permissions. AzMan is available from the time of ASP.NET, but it is still available in Windows 8 as well as Windows Server 2012. The Enterprise Library Security Application Block was built with the AzMan wrapper, but the latest version of Enterprise Library does not have this, so one must write a wrapper of their own (refer to an earlier version of Enterprise Library for the code). How to use AzMan in ASP.Net Application AzMan is installed by default in Windows 7 and Windows Server 2008 and above. As I mentioned above, the AzMan policy store can be created in Active Directory or in XML.

AzMan Policy Store in XML

In the Management Console, click on "Actions" and select "Options", here you need to ensure that you have selected "Developer Mode"; this is being done for creating a new policy because New Policy can only be created in "Developer Mode". As soon as you will do that you will get a new option under the "Actions" Menu named "New Authorization Store", open this Action and select "Authorization Store Type" as "XML" and provide the location of the XML File, where we will define the policies. Now you will see the XML file you added under Authorization Manager on the left-hand panel of the console, select your policy and right-click and open "Properties", We need to give administrator rights to the "Network Service" since an ASP.NET application will use this account by default, if someone wants to impersonate some other account then that can also be done. Now we need to create a new application, in my case, it is "SampleApplication". This is where we maintain the groups, users, roles, and permissions for a specific application, since we can apply a single policy to many applications, with each application having various mappings among roles, users, and permissions. See the following: Now we will see how to create tasks and operations. To create new operations, under the policy select the application you want to create the task for, in my case it is "SampleApplication", under it, expand "Definitions" and select "Operation Definitions", right-click on it and select "New Operation Definition". I created three operations, "Edit", "View", and "Delete". Similarly for adding Tasks, select "Task Definitions", right-click on it, and "New Task Definitions". Here we will create the new task and will map the operations with these tasks. Here I have created two new tasks, in other words, "Admin Tasks" and "Guest Task". Now we can create the roles and associate them with the tasks and the users. So we can give permission to a specific role on a task and then users can be assigned to a specific role so as to provide them access to all the tasks mapped to that role. Now for adding roles, just select "Role Definitions", right-click on it, and "New Role Definitions". Here we will create a new role and will map the tasks with these roles. Here I have created two new roles, in other words, "Admin" and "Guest". (One can also map the operations instead of mapping tasks.) Now for assigning users to the roles created above, select "Role Assignments" in the console tree, right-click on it and select "New Role Assignment", now select the role for which you want to map users. Now you will see that the two new roles are added to the console tree under "Role Assignments". Now right-click on each role and select the users from the active directory so as to assign a role to the users. Do it for both the roles and with this, you are done, now we can use the policy we created, in other words, "SamplePolicy", in the application. Before going into how to use it in an application, first, let's have a look at using Active Directory with Policy Store directly.