AzMan Nested Roles not finding user in role

I'm using AzMan (1.0) for an ASP.Net web app, and I have a question about nested Roles.

Say I have the following roles: MyApp MyAppUser MyAppAdmin MyAppSupport

For the most part, all users (MyApp) can access the app, but some functions will be specific to the other roles.

I want to declaratively restrict access to the web pages to members of the MyApp role.

[PrincipalPermission(SecurityAction.Demand, Role 开发者_高级运维= "MyApp")]

I will check User.IsInRole or use the AzMan API to check for operation permissions within my code.

The users are assigned to the lower level roles (user, admin, support) and those roles are added to the MyApp role.

The problem is that when I check if the user is a member of the MyApp role, they aren't, even though the role they are in belongs to the MyApp role. Is the only way to check this is to recursively go through all the roles? That'd mean I cant use the declarative security, or to do so I'd have to add all users to the top level group as well (not ideal).

---

It sounds like you're expecting composite Role Definition (where a Role Definition is defined to include other Role Definitions) to be supported in the call to IsInRole(). I think you'd get the results you want if you used Group inheritance and Role Assignment instead.

In other words, rather than depending on IsInRole to follow the Role Definition for "MyApp" to determine that the Role Definition "MyAppAdmin" is part of that definition, create the inheritance using Groups instead, and then assign one or more groups to your Role Definition using Role Assignment. You could create an "Administrators" group, which might be a member of the "Everyone" group.

I'm really thinking that your role names are really better group names. A role signifies certain capabilities, not a classification of users based on their rights. That's what a group is for.

For example, suppose that most users (not admins or support) have read-only access to your app. I tend to call that role "Viewer" and I assign it the tasks or operations that allows users in that role only the ability to view, not edit, any data. I would assign everyone to that role (whether I do that with just one group or several doesn't really matter). The "Support" role allows users assigned to it to perform certain operations (or tasks grouping operations). Only some people would be assigned to that role (again, maybe they are assigned individually, or I have a group named "Customer Support Reps" -- doesn't matter).

In my app, I could check IsInRole("Viewer") and everyone who is a user will be in that role. But if I check IsInRole("Support"), only the people in the "Customer Support Reps" group assigned to that role would return True.