authorization

Should unauthorized actions in the UI be hidden, disabled, or result in an error? [closed]

巧了我就是萌 提交于 2019-11-30 10:55:22
问题 Closed . This question is opinion-based. It is not currently accepting answers. Want to improve this question? Update the question so it can be answered with facts and citations by editing this post. Closed 12 months ago . This is a perennial question for me that I've never really resolved so I'd like your input. If I have actions that I know a user will not be able to perform due to insufficient privileges or object state, should the UI elements for those actions be hidden from the user,

How to verify which resources each user can access with OAuth and OpenID Connect?

好久不见. 提交于 2019-11-30 10:48:50
问题 Suppose we have some RESTful API whose resources we want to expose. End users will work with this API through client applications like mobile apps and Javascript based clients that run on web browsers. With OAuth 2.0 this RESTful API will lie on the Resource Server and we will have one Authorization Server on which the client applications are registered. The users will then be registered at the authorization server and will be able to grant permission to those applications access resources on

ASP.NET MVC custom authorization

妖精的绣舞 提交于 2019-11-30 10:38:24
I am building a web application using ASP.NET MVC that has two very distinct types of users. I'll contrive an example and say that one type is content producers (publishers) and another is content consumers (subscribers). I am not planning on using the built-in ASP.NET authorization stuff, because the separation of my user types is a dichotomy, you're either a publisher or a subscriber, not both. So, the build-in authorization is more complex than I need. Plus I am planning on using MySQL. I was thinking about storing them in the same table with an enum field (technically an int field). Then

Override the User.IsInRole and [Authorize(Roles = “Admin”)] for MVC4 application

此生再无相见时 提交于 2019-11-30 10:27:56
I have created a custom role provider for my MVC4 application where I have been successfully able to override CreateRole, GetAllRoles and RoleExists methods and link them to my existing database as follows: namespace Project.Providers { public class MyProvider : System.Web.Security.SqlRoleProvider { private MyContext dbcontext = new MyContext(System.Configuration.ConfigurationManager.ConnectionStrings["MyContext"].ConnectionString); private Repository<MyUser> userRepository; private Repository<Role> roleRepository; public MyProvider() { this.userRepository = new Repository<MyUser>(dbcontext);

Authorization for github.com on Android

隐身守侯 提交于 2019-11-30 10:20:52
Help me please. I make client for android for github.com api v3 and i have a trouble with authorization. (login = mytest12345 , pass = 12345test) http://developer.github.com/v3/ Python authorization sample http://agrimmsreality.blogspot.com/2012/05/sampling-github-api-v3-in-python.html serverurl="https://api.github.com" # Add your username and password here, or prompt for them auth=BasicAuth(user, password) # Use your basic auth to request a token # This is just an example from http://developer.github.com/v3/ authreqdata = { "scopes": [ "public_repo" ], " note": "admin script" } resource =

AuthorizeAttribute with Roles but not hard-coding the Role values

风流意气都作罢 提交于 2019-11-30 10:15:26
Is it possible to add the Roles but not hard-coding the values like: [Authorize(Roles="members, admin")] I would like to retrieve these roles from a database or configuration file where I wouldn't need to rebuild the application if I needed to add/remove Roles for a Controller Action. I know with the enums it can be done... http://www.vivienchevallier.com/Articles/create-a-custom-authorizeattribute-that-accepts-parameters-of-type-enum but even this is still not flexible enough for my needs; it's still somewhat of a hard-code, even though it is cleaner. You can create your custom authorization

Google Maps Android API Authorization failure - has this service changed in the last few months?

大憨熊 提交于 2019-11-30 10:08:06
I have coded a Xamarin Google Apps V2 application. The device I am deploying to has Google Play Services installed. The application has all been setup correctly in the API console and I have had this application working before, months ago. Currently, when the application is deployed to my device, I am getting the following errors in the Application output: [Google Maps Android API] Authorization failure. Please see https://developers.google.com/maps/documentation/android/start for how to correctly set up the map. [Google Maps Android API] Ensure that the following correspond to what is in the

WCF Service authorization patterns

笑着哭i 提交于 2019-11-30 09:52:27
I'm implementing a secure WCF service. Authentication is done using username / password or Windows credentials. The service is hosted in a Windows Service process. Now, I'm trying to find out the best way to implement authorization for each service operation. For example, consider the following method: public EntityInfo GetEntityInfo(string entityId); As you may know, in WCF, there is an OperationContext object from which you can retrieve the security credentials passed in by the caller/client. Now, authentication would have already finished by the time the first line in the method is called.

What are some good role authorization solutions used with Authlogic?

不想你离开。 提交于 2019-11-30 09:50:56
I am looking for a good role based authorization solution to use alongside Authlogic. Anyone have any good suggestions? Please list some pros and cons from your experience if possible please. Acl9 works great with AuthLogic: http://github.com/be9/acl9/tree/master At RailsConf, I saw a lightning talk on Lockdown and was very impressed. Anyone with a modest amount of db and rails experience can roll their own ACL system, but Lockdown looks nice because it tries to keep the permission stuff out of the way. http://lockdown.rubyforge.org/ I had used role_requirement previously but I didn't dig it.

How do I allow all users access to one route within a website with integrated auth?

杀马特。学长 韩版系。学妹 提交于 2019-11-30 09:11:27
问题 I have an ASP.Net MVC app using Integrated Security that I need to be able grant open access to a specific route. The route in question is ~/Agreements/Upload . I have tried a few things and nothing has worked thus far. <configuration> <location path="~/Agreements/Upload"> <system.web> <authorization> <allow users="*"/> </authorization> </system.web> </location> </configuration> In IIS under Directory Security > Authentication Methods I only have "Integrated Windows Authentication" selected.