Static factory classes were the default approach for creating objects with versions prior to 5.0. This approach is no longer recommended but is still available for backward compatibility.

The following is the syntax to create deafult and named Authorization Provider instances using the static AuthorizationFactory class:

//Instantiating Using Static Factory - Default Authorization Provider
IAuthorizationProvider defaultAuthorizationProvider = AuthorizationFactory.GetAuthorizationProvider();
//Instantiating Using Static Factory - Named Authorization Provider
IAuthorizationProvider namedAuthorizationProvider = AuthorizationFactory.GetAuthorizationProvider("AuthzProvider");

The following is the syntax to create deafult and named Security Cache Provider instances using the static SecurityCacheFactory class:

//Instantiating Using Static Factory - Default Security Cache Provider
ISecurityCacheProvider defaultSecurityCacheProvider = SecurityCacheFactory.GetSecurityCacheProvider();
//Instantiating Using Static Factory - Named Security Cache Provider
ISecurityCacheProvider namedSecurityCacheProvider = SecurityCacheFactory.GetSecurityCacheProvider("SecurityCache");

This approach is recommended for applications with few dependencies. The EnterpriseLibraryContainer class exposes a static property called Current of type IServiceLocator, which resolves and gets an instance of the specified type.

The following is the syntax to create default and named Authorization Provider instances using the EnterpriseLibraryContainer class:

//Instantiating Using Unity Service Locator - Default Authorization Provider
IAuthorizationProvider defaultAuthorizationProvider = EnterpriseLibraryContainer.Current.GetInstance<IAuthorizationProvider>();
//Instantiating Using Unity Service Locator - Named Authorization Provider
IAuthorizationProvider namedAuthorizationProvider = EnterpriseLibraryContainer.Current.GetInstance<IAuthorizationProvider>("AuthzProvider");

The following is the syntax to create default and named Security Cache Provider instances using the EnterpriseLibraryContainer class:

//Instantiating Using Unity Service Locator - Default Security Cache Provider
ISecurityCacheProvider defaultSecurityCacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>();
//Instantiating Using Unity Service Locator - Named Security Cache Provider
ISecurityCacheProvider namedSecurityCacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>("SecurityCache");

Larger complex applications demand looser coupling; this approach leverages the dependency injection mechanism to create objects instead of explicitly creating instances of concrete implementations. Unity container stores the type registrations and mappings in the configuration file and instantiates the appropriate type whenever requested. This allows us to change the type in the configuration without re-compiling the code and essentially to change the behavior from outside.

The following is the syntax to create default and named Authorization Provider instances using the UnityContainer class:

var container = new UnityContainer();
container.AddNewExtension<EnterpriseLibraryCoreExtension>();
//Instantiating Using Unity Container Directly - Default Authorization Provider
IAuthorizationProvider defaultAuthorizationProvider = container.Resolve<IAuthorizationProvider>();
//Instantiating Using Unity Container Directly - Named Authorization Provider
IAuthorizationProvider namedAuthorizationProvider = container.Resolve<IAuthorizationProvider>("AuthzProvider");

The following is the syntax to create default and named Security Cache Provider instances using the UnityContainer class:

var container = new UnityContainer();
container.AddNewExtension<EnterpriseLibraryCoreExtension>();
//Instantiating Using Unity Container Directly - Default Security Cache Provider
ISecurityCacheProvider defaultSecurityCacheProvider = container.Resolve<ISecurityCacheProvider>();
//Instantiating Using Unity Container Directly - Named Security Cache Provider
ISecurityCacheProvider namedSecurityCacheProvider = container.Resolve<ISecurityCacheProvider>("SecurityCache");

The AuthorizationRuleProvider class is an implementation that evaluates Boolean expressions to determine whether the objects are authorized; these expressions or rules are stored in the configuration file. We can create authorization rules using the Rule Expression Editor part of the Enterprise Library configuration tool and validate them using the Authorize method of the Authorization Provider. This authorization provider is part of the Microsoft.Practices.EnterpriseLibrary.Security namespace.

Authorizing using Authorization Rule Provider

As discussed earlier, Authorization Rule Provider stores authorization rules in the configuration and this is one of the simplest ways to perform authorization. Basically, we need to configure to use the Authorization Rule Provider and provide authorization rules based on which the authorization will be performed.

Let us add Authorization Rule Provider as our Authorization Provider; click on the plus symbol on the right side of the Authorization Providers and navigate to the Add Authorization Rule Provider menu item.

The following screenshot shows the configuration options of the Add Authorization Rule Provider menu item:

The following screenshot shows the default configuration of the newly added Authorization Provider; in this case, it is Authorization Rule Provider:

Now we have the Authorization Rule Provider added to the configuration but we still need to add the authorization rules. Imagine that we have a business scenario where:

• We have to allow only users belonging to the administrator's role to add or delete products.
• We should allow all authenticated customers to view the products.

This scenario is quite common where certain operations can be performed only by specific roles, basically role-based authorization. To fulfill this requirement, we will have to add three different rules for add, delete, and view operations. Right-click on the Authorization Rule Provider and click on the Add Authorization Rule menu item as shown on the following screenshot.

The following screenshot shows the newly added Authorization Rule:

Let us update the name of the rule to "Product.Add" to represent the operation for which the rule is configured. We will provide the rule using the Rule Expression Editor; click on the right corner button to open the Rule Expression Editor. The requirement is to allow only the administrator role to perform this action. The following action needs to be performed to configure the rule:

1. Click on the Role button to add the Role expression: R.
2. Enter the role name next to the role expression: R:Admin.
3. Select the checkbox Is Authenticated to allow only authenticated users.

The following screenshot displays the Rule Expression Editor dialog box with the expression configured to R:Admin.

The following screenshot shows the Rule Expression property set to R:Admin.

Now let us add the rule for the product delete operation. This rule is configured in a similar fashion. The resulting configuration will be similar to the configuration shown.

The following screenshot displays the added authorization rule named Product.Delete with the configured Rule Expression:

Alright, we now have to allow all authenticated customers to view the products. Basically we want the authorization to pass if the user is either of role Customer; also Admin role should have permission, only then the user will be able to view products. We will add another rule called Product.View and configure the rule expression using the Rule Expression Editor as given next. While configuring the rule, use the OR operator to specify that either Admin or Customer can perform this operation.

The following screenshot displays the added authorization rule named Product.View with the configured Rule Expression:

Now that we have the configuration ready, let us get our hands dirty with some code. Before authorizing we need to authenticate the user; based on the authentication requirement we could be using either out-of-the-box authentication mechanism or we might use custom authentication. Assuming that we are using the current Windows identity, the following steps will allow us to authorize specific operations by passing the Windows principal while invoking the Authorize method of the Authorization Provider.

1. The first step is to get the IIdentity and IPrincipal based on the authentication mechanism. We are using current Windows identity for this sample.

   WindowsIdentity windowsIdentity = WindowsIdentity.GetCurrent();
   WindowsPrincipal windowsPrincipal = new WindowsPrincipal(windowsIdentity);
   

2. Create an instance of the configured Authorization Provider using the AuthorizationFactory.GetAuthorizationProvider method; in our case we will get an instance of Authorization Rule Provider.

   IAuthorizationProvider authzProvider = AuthorizationFactory.GetAuthorizationProvider("Authorization Rule Provider");
   

3. Now use the instance of Authorization Provider to authorize the operation by passing the IPrincipal instance and the rule name.

   bool result = authzProvider.Authorize(windowsPrincipal, "Product.Add");
   

AuthorizationFactory.GetAuthorizationProvider also has an overloaded alternative without any parameter, which gets the default authorization provider configured in the configuration.

The AzManAuthorizationProvider class provides us the ability to define individual operations of an application, which then can be grouped together to form a task. Each individual operation or task can then be assigned roles to perform those operations or tasks. The best part of Authorization Manager is that it provides an administration tool as a Microsoft Management Console (MMC) snap-in to manage users, roles, operations, and tasks. Policy administrators can configure an Authorization Manager Policy store in an Active Directory, Active Directory Application Mode (ADAM) store, or in an XML file. This authorization provider is part of the Microsoft.Practices.EnterpriseLibrary.Security namespace.

The CachingStoreProvider class is a concrete implementation of the SecurityCacheProvider class; it leverages the Caching Application Block for its caching needs. This class provides the logic to obtain a token for an authenticated user and manage caching for authenticated IIdentity, IPrincipal, or Profile objects (such as the ASP.NET Profile object). The CachingStoreProvider class is part of the Microsoft.Practices.EnterpriseLibrary.Security.Cache.CachingStore namespace.

To leverage security caching related functionality, let us add the built-in CachingStoreProvider Security Cache Provider in the configuration. This provider uses the caching mechanism implemented by the Caching Application Block. In the configuration file, click on the plus symbol of the Security Caches section and navigate to the Add Security Cache menu item as shown in the following screenshot:

The following screenshot shows the default configuration of Security Cache:

We have configured the Security Cache Provider and are ready to use it in our code to perform various actions against the Security Cache Provider.

Frequent authentication of user during a single session may lead to performance degradation of the application; we can obtain a temporary token by saving a user principal or a user identity in the security cache. We can save user identity, principal and/or profile; one or more objects can be combined using the same token. Caching an IIdentity, IPrincipal, or Profile is just a two-step process; everything else is taken care of by the configuration. As mentioned earlier, Security Cache Provider uses the Caching Application Block for caching, which gives us all the flexibility of configuration to select the storage mechanism, encryption, and expiration policy. Also, the generated IToken can be used to retrieve cached items or mark them for expiration.

The following code snippet gets the current Windows identity and checks whether the identity is authenticated. Upon validation, the instance of Security Cache Provider is used to save the identity and generate the token:

//Get current Windows Identity
WindowsIdentity identity = WindowsIdentity.GetCurrent();
if (identity.IsAuthenticated)
{
ISecurityCacheProvider cacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>();
//Cache User Identity and generate token
IToken token = cacheProvider.SaveIdentity(identity);
}

The following code snippet gets the current Windows identity and for the purposes of the demonstration, creates a GenericPrincipal object with Manager role. The instance of Security Cache Provider is used to save the principal and generate the token:

//Get current Windows Identity
WindowsIdentity identity = WindowsIdentity.GetCurrent();
//Constructing dummy Principal Object for demonstration
GenericPrincipal principal = new GenericPrincipal(identity, new string[] { "Manager" });
if (identity.IsAuthenticated)
{
ISecurityCacheProvider cacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>();
//Cache IPrincipal and generate token
IToken token = cacheProvider.SavePrincipal(principal);
}

The following code snippet demonstrates the Profile caching feature; the SaveProfile method of Security Cache Provider is used to save the profile object and generate the token:

ISecurityCacheProvider cacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>();
IToken token = cacheProvider.SaveProfile(HttpContext.Current.Profile);

The following code block first creates an instance of the Security Cache Provider and then saves the respective items, which generates an IToken instance, which can be used to retrieve the respective item. Currently IToken is an instance of GuidToken, which generates a Guid; this can be stored for the user's session in the appropriate location based on the application type. The token can be re-generated using the Guid and authentication information can be validated as well as authorization being performed by retrieving the IPrincipal instance from the security cache.

The following code snippet demonstrates how to retrieve the Identity object using the generated token:

//Get current Windows Identity
IIdentity identity = WindowsIdentity.GetCurrent();
ISecurityCacheProvider cacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>();
//Cache Identity and generate token
IToken token = cacheProvider.SaveIdentity(identity);
//Retrieve Identity using token
IIdentity cachedIdentity = cacheProvider.GetIdentity(token);

The following code snippet demonstrates how to retrieve the Principal object using the generated token:

//Constructing dummy Principal Object for demonstration
GenericPrincipal principal = new GenericPrincipal(Page.User.Identity, new string[] { "Manager" });
if (Page.User.Identity.IsAuthenticated)
{
ISecurityCacheProvider cacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>();
//Cache IIdentity and generate token
IToken token = cacheProvider.SaveIdentity(Page.User.Identity);
//Cache IPrincipal and group token with related items
cacheProvider.SavePrincipal(principal, token);
//Retrieve cached Principal using token
cacheProvider.GetPrincipal(token);
}

The following code snippet demonstrates how to retrieve the Profile object using the generated token:

ISecurityCacheProvider cacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>();
//Cache Profile object and generate token
IToken token = cacheProvider.SaveProfile(HttpContext.Current.Profile);
//Retrieve cached Profile using token
ProfileBase profile = cacheProvider.GetProfile(token) as ProfileBase;

Security Cache Provider also provides the ability to expire the cached item when the user logs out of the system or the session ends so that the token cannot be misused. This functionality is part of the ExpireIdentity, ExpirePrincipal, and ExpireProfile methods of Security Cache Provider. In the given code blocks, we are creating an instance of the Security Cache Provider and then saving the respective items, which generates an IToken instance. The same token is used to force expiration of the cached item. Please note we are deliberately performing the cache and immediately forcing expiration in the next line just to give you the full picture.

The following code snippet demonstrates how to purge/expire the saved Identity using the generated token:

ISecurityCacheProvider cacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>();
//Cache IIdentity and generate token
IToken token = cacheProvider.SaveIdentity(Page.User.Identity);
//Purge/Expire an existing cached Identity using token
cacheProvider.ExpireIdentity(token);

The following code snippet demonstrates how to purge/expire the saved Principal using the generated token:

//Constructing dummy Principal Object for demonstration
GenericPrincipal principal = new GenericPrincipal(Page.User.Identity, new string[] { "Manager" });
if (Page.User.Identity.IsAuthenticated)
{
ISecurityCacheProvider cacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>();
//Cache IIdentity and generate token
IToken token = cacheProvider.SaveIdentity(Page.User.Identity);
//Cache IPrincipal and group token with related items
cacheProvider.SavePrincipal(principal, token);
//Purge/Expire the existing cached Principal using token
cacheProvider.ExpirePrincipal(token);
}

The following code snippet demonstrates how to purge/expire the saved Profile object using the generated token:

ISecurityCacheProvider cacheProvider = EnterpriseLibraryContainer.Current.GetInstance<ISecurityCacheProvider>();
//Cache Profile object and generate token
IToken token = cacheProvider.SaveProfile(HttpContext.Current.Profile);
//Purge/Expire the cached Profile using token
cacheProvider.ExpireProfile(token);