The latest (1.3) release of Caveman Tools toolkit, includes functionality to make authorization with groups and rights a breeze (take a look at the tutorial). However for the next release, I've added support for authorization in multiple scopes, which will make it much easier for multi tenant applications to deal with request authorization. This post refers to the version 1.3.5 (unreleased yet) of CavemanTools.
I'm talking about web application hosting scenario, similar to what wordpress.com, bloger, getsatisfaction, github or bitbucket do, where people register with them to have their own instance of the specific service. However, every member is also a user of the global service (not limited to an account only) but their rights are specific to an account. So you can be the admin of your account, but you're a simple user for the other accounts.
Let's say for example, you're a github user browsing https://github.com/SamSaffron/dapper-dot-net . The account name is SamSaffron and let's suppose its id is 497. You, as a github user can browse the dapper-dot-net repository but you can't do much, your rights don't allow it. However, Sam has admin rights on this account, but if he goes to https://github.com/restsharp/RestSharp , he's just a simple user there. So Sam is a global github user with specific rights depending on what github location he's visiting.
If you're building such an application, Caveman Tools makes it a breeze to handle the above scenario. Scoped authorization means that the authorization is handled according to an active scope (or context). If there is no scope set, then it's assumed there is a global scope.
Your application membership schema needs to implement the concepts of users belonging to groups (or roles, but I call them groups in Caveman Tools) which can be associated or not with an account . A group holds rights valid for the account associated with it. If no account exists, it's assumed the group is global and the rights apply in every scope.
First, Caveman Tools provides an interface for you to implement.
In this is example, Sam is member of the global group with id 1 and of the group with id 2 which is associated with the 'SamSaffron' account id 497. The DefaultAuthorizationScopeId suports integers as ids, but you can implement your own type of scope id by extending the AuthorizationScopeId abstract class. The GetDefaultGroup methods returns the group for anonymous users.
public class TestUserRepo:interface IUserRightsRepository
{
public IEnumerable<IUserContextGroup> GetGroupsById(IEnumerable<int> ids)
{
return new[]
{
new UserContextGroup(1, new ushort[] (UserRights.Browse), //can browse public repositories
new UserContextGroup(2,new ushort[]{UserRights.DoEverything}){ScopeId = new DefaultAuthorizationScopeId(497)}, //admin for account 497
};
}
public IUserContextGroup GetDefaultGroup()
{
return new UserContextGroup(0,new ushort[0]);
}
}
When a user logs in, you should retrieve his id and the groups the user belongs to. Next, you setup the authentication cookie (you must use this helper)
Response.SetAuthCookie(userId, name, groups);
Enable the CavemanUserContext in order for all the good stuff to happen.
GlobalFilters.Filters.Add(new CavemanUserContext());
It's important to always establish the scope of a request i.e what account the user is browsing. When someone goes to the GitHub's homepage, that's the global scope, but when browsing https://github.com/restsharp/RestSharp, the scope is restsharp. Usually you get the scope name from the url, then look for its corresponding id in the database (in this example the id of restsharp is 508) . Once you know the scope id, you just need to set it.
AuthenticationUtils.SetAuthScope(new DefaultAuthorizationScopeId(508));
That's all the setup needed.
To require authorization, you can use the DemandRightAttribute (on the controller or on a method)
[DemandRight(UserRights.DoEverything)]
public class AdminController:Controller {}
Or manually
this.GetUserContext().HasRightTo(UserRights.DoEverything)
The authorization takes into account the current scope: if no scope if set, then only the global rights are checked, but if there is a scope, then both the rights associated with the scope and global rights are checked. So Sam is allowed to access https://github.com/SamSaffron/Admin , but he's denied access to https://github.com/restsharp/Admin.
If you're interested in the internals of how CavemanTools handles authorization, check out the source code.