Extending role based security to allow roles for a specific entity

Question

I've used FluentSecurity in another MVC application and its great, provides a slick implementation.

I now have a requirement to offer application wide roles, plus also provide additional permission control over individiual entities.

My application manages particular locations and a user may have permissions to perform actions at one or more locations, each location has a unique id. I'll need to check a user has a particular role for the location id (effectively adding another dimension to roles). I've got my schema mapped out, along with my repo/service layers.

I was wondering if someone has tackled this type of problem before and whether its worth me trying to solve with FluentSecurity or if I should validate the user has the role required for the location on each GET/POST request (controller or service layer).

I'm getting to achieve this in FluentSecurity I'll have to roll my own policy and capture the location id from the RequestContext.RouteData.

Answer 1

I haven't done exactly what you need to do, but creating a custom policy in FluentSecurity that handles your scenario should not be hard at all. If you feel it is, please let me know and I will have to fix that.

You can find more information on how to create custom policies here:

https://github.com/kristofferahl/FluentSecurity/wiki/Custom-policies

It sounds to me like you might want to split it into two custom policies. You then apply your custom policies like this:

configuration.For<SomeController>()
    .AddPolicy<CustomPolicy1>()
    .AddPolicy<CustomPolicy2>();