authorization | 易学教程

ASP.NET MVC custom authorization

阅读更多关于 ASP.NET MVC custom authorization

问题 I am building a web application using ASP.NET MVC that has two very distinct types of users. I'll contrive an example and say that one type is content producers (publishers) and another is content consumers (subscribers). I am not planning on using the built-in ASP.NET authorization stuff, because the separation of my user types is a dichotomy, you're either a publisher or a subscriber, not both. So, the build-in authorization is more complex than I need. Plus I am planning on using MySQL. I

Custom authorization attribute not working in WebAPI

阅读更多关于 Custom authorization attribute not working in WebAPI

问题 public class CustomAuthorizeAttribute : AuthorizationFilterAttribute { protected override bool AuthorizeCore(HttpContextBase httpContext) { return true;// if my current user is authorised } } Above is my CustomAuthorizeAttribute Class and [CustomAuthorize] // both [CustomAuthorize] and [CustomAuthorizeAttribute ] I tried public class ProfileController : ApiController { //My Code.. } When I'm calling http://localhost:1142/api/Profile It is not firing CustomAuthorizeAttribute More over My

rails leaving out some parts from fragment caching

阅读更多关于 rails leaving out some parts from fragment caching

I have a rails 4 app using pundit gem for authorization. If I do russian-doll fragment caching like the code below, the conditional statement used for authorization will be also cached, which is not good, since edit/delete buttons should only be available for the post.user . What is the good way to get around this? Should I split the cache into smaller parts or is there a way to exclude some parts of the caching? What's the rails convention in this case? index.html.erb <% cache ["posts-index", @posts.map(&:id), @posts.map(&:updated_at).max, @posts.map {|post| post.user.profile.updated_at}.max]

ActiveMQ authorization

阅读更多关于 ActiveMQ authorization

问题 If I want to implement JAAS authorization on Apache ActiveMQ, do I have to use the plug-in in the activemq.xml configuration file? This way is really NOT good because if I want to change authorization, I have to change the activemq.xml file and restart the server in order to work. Is there any way I can use like JAAS authentication by changing other properties file rather than the activemq.xml file? Or can I custom my own authorization plugin? Thanks. 回答1: Whenever I have set up ActiveMQ

ASP.NET MVC. Check if user is authorized from JavaScript

阅读更多关于 ASP.NET MVC. Check if user is authorized from JavaScript

问题 I'm using ASP.NET MVC Framework 3 and Forms Authentication. I know, how to check on servers side, if the user is authorized for some action (with [Authorize] ) and I know, how to check this within an action or a view (with User.Identity.IsAuthenticated or other members of 'User'). What I'm trying to do - is to define some JavaScript code, that will be executed differently, depending if the user is authorized. Consider such script on the page: <script> function Foo(){ if(userAuthorized) alert(

Can someone explain this block of ASP.NET MVC code to me, please?

阅读更多关于 Can someone explain this block of ASP.NET MVC code to me, please?

问题 this is the current code in ASP.NET MVC2 (RTM) System.Web.Mvc.AuthorizeAttribute class :- public virtual void OnAuthorization(AuthorizationContext filterContext) { if (filterContext == null) { throw new ArgumentNullException("filterContext"); } if (this.AuthorizeCore(filterContext.HttpContext)) { HttpCachePolicyBase cache = filterContext.HttpContext.Response.Cache; cache.SetProxyMaxAge(new TimeSpan(0L)); cache.AddValidationCallback( new HttpCacheValidateHandler(this.CacheValidateHandler),

Java Google Contacts API Access Service Account Authentication

阅读更多关于 Java Google Contacts API Access Service Account Authentication

I'm trying to access Googles Contacts API but my attempt failed already on getting authorized. From other (web) languages i'm used to the APIConsole and the public API-key (authorization). GoogleCredential credential = new GoogleCredential().setAccessToken("<<PublicAPIKey>>"); System.out.println(credential.refreshToken()); // false This way I'm not able to refresh the token and be unsure about using the public-key as accesstoken ... Instead I tried over a service account : private static final String USER_ACCOUNT_EMAIL = "xy@gmail.com"; private static final String SERVICE_ACCOUNT_EMAIL = "xy

How do I allow all users access to one route within a website with integrated auth?

阅读更多关于 How do I allow all users access to one route within a website with integrated auth?

I have an ASP.Net MVC app using Integrated Security that I need to be able grant open access to a specific route. The route in question is ~/Agreements/Upload . I have tried a few things and nothing has worked thus far. <configuration> <location path="~/Agreements/Upload"> <system.web> <authorization> <allow users="*"/> </authorization> </system.web> </location> </configuration> In IIS under Directory Security > Authentication Methods I only have "Integrated Windows Authentication" selected. Now, this could be part of my problem (as even though IIS allows the above IIS doesn't). But if that's

Alternatives to spring-security in Java (spring)

阅读更多关于 Alternatives to spring-security in Java (spring)

问题 I'm looking for a good security framework that allows to annotate parameter based access rules to methods. Basicly i want to check if the authenticated user is allowed to call a certain method with a specific object as a parameter. Spring security would serve my needs but because of this (spring forum) i'm looking for alternatives if i'm unable to get it to work. Requirements: method security based on config or annotations, i want to avoid puting my security code insite my service methods

Using MVC's AuthorizeAttribute with multiple groups of Roles?

阅读更多关于 Using MVC's AuthorizeAttribute with multiple groups of Roles?

问题 What I want to do is a two-level role check on an action handler. For example, Require that the users is in at least one of the following groups: SysAdmins, Managers AND in at least one of the following groups: HR, Payroll, Executive. Initial guess was that this might be the way to do this but I don't think it is: [Authorize(Role="SysAdmins,Managers")] [Authorize(Role="HR,Payroll,Executive")] public ActionResult SomeAction() { [...] } Do I need to role my own custom Attribute to take in Role1