PrincipalPermissionMode PrincipalPermissionMode PrincipalPermissionMode PrincipalPermissionMode Enum

Definizione

Imposta la modalità per i controlli delle autorizzazioni quando si utilizza la classe PrincipalPermissionAttribute per controllare l'accesso a un metodo.Sets the mode for authorization checks when using the PrincipalPermissionAttribute to control access to a method.

public enum class PrincipalPermissionMode
public enum PrincipalPermissionMode
type PrincipalPermissionMode = 
Public Enum PrincipalPermissionMode
Ereditarietà
PrincipalPermissionModePrincipalPermissionModePrincipalPermissionModePrincipalPermissionMode

Campi

Always Always Always Always 4

Consente sempre all'utente di specificare una classe IPrincipal per CurrentPrincipal.Always enables the user to specify a IPrincipal class for CurrentPrincipal.

Custom Custom Custom Custom 3

Consente all'utente di specificare una classe IPrincipal personalizzata per la proprietà CurrentPrincipal.Enables the user to specify a custom IPrincipal class for CurrentPrincipal.

None None None None 0

La proprietà CurrentPrincipal non è impostata.CurrentPrincipal is not set.

UseAspNetRoles UseAspNetRoles UseAspNetRoles UseAspNetRoles 2

La proprietà CurrentPrincipal viene impostata in base al provider di ruoli ASP.NETASP.NET (RoleProvider).CurrentPrincipal is set based on the ASP.NETASP.NET role provider (RoleProvider).

UseWindowsGroups UseWindowsGroups UseWindowsGroups UseWindowsGroups 1

La proprietà CurrentPrincipal viene impostata in base a Windows (WindowsPrincipal).CurrentPrincipal is set based on Windows (WindowsPrincipal). Se l'identità dell'utente non è associata a un account di Windows, viene utilizzata l'identità anonima di Windows.If the user identity is not associated with a Windows account, anonymous Windows is used.

Esempi

Nell'esempio seguente viene illustrato come specificare UseAspNetRoles.The following example shows how to specify UseAspNetRoles.

namespace TestPrincipalPermission
{
    class PrincipalPermissionModeWindows
    {
    
        [ServiceContract]
        interface ISecureService
        {
            [OperationContract]
            string Method1();
        }
                
        class SecureService : ISecureService
        {
            [PrincipalPermission(SecurityAction.Demand, Role = "everyone")]
            public string Method1()
            {
                return String.Format("Hello, \"{0}\"", Thread.CurrentPrincipal.Identity.Name);
            }
        }

        public void Run()
        {
            Uri serviceUri = new Uri(@"http://localhost:8006/Service");
            ServiceHost service = new ServiceHost(typeof(SecureService));
            service.AddServiceEndpoint(typeof(ISecureService), GetBinding(), serviceUri);
            service.Authorization.PrincipalPermissionMode = PrincipalPermissionMode.UseAspNetRoles;
            service.Open();

            EndpointAddress sr = new EndpointAddress(
                serviceUri, EndpointIdentity.CreateUpnIdentity(WindowsIdentity.GetCurrent().Name));
            ChannelFactory<ISecureService> cf = new ChannelFactory<ISecureService>(GetBinding(), sr);
            ISecureService client = cf.CreateChannel();
            Console.WriteLine("Client received response from Method1: {0}", client.Method1());
            ((IChannel)client).Close();
            Console.ReadLine();
            service.Close();
            
        }

        public static Binding GetBinding()
        {
            WSHttpBinding binding = new WSHttpBinding(SecurityMode.Message);
            binding.Security.Message.ClientCredentialType = MessageCredentialType.Windows;
            return binding;
        }
    }
}
Namespace TestPrincipalPermission
	Friend Class PrincipalPermissionModeWindows

		<ServiceContract> _
		Private Interface ISecureService
			<OperationContract> _
			Function Method1() As String
		End Interface

		Private Class SecureService
			Implements ISecureService
            <PrincipalPermission(SecurityAction.Demand, Role:="everyone")> _
            Public Function Method1() As String Implements ISecureService.Method1
                Return String.Format("Hello, ""{0}""", Thread.CurrentPrincipal.Identity.Name)
            End Function

		End Class

		Public Sub Run()
			Dim serviceUri As New Uri("http://localhost:8006/Service")
			Dim service As New ServiceHost(GetType(SecureService))
			service.AddServiceEndpoint(GetType(ISecureService), GetBinding(), serviceUri)
			service.Authorization.PrincipalPermissionMode = PrincipalPermissionMode.UseAspNetRoles
			service.Open()

			Dim sr As New EndpointAddress(serviceUri, EndpointIdentity.CreateUpnIdentity(WindowsIdentity.GetCurrent().Name))
			Dim cf As New ChannelFactory(Of ISecureService)(GetBinding(), sr)
			Dim client As ISecureService = cf.CreateChannel()
			Console.WriteLine("Client received response from Method1: {0}", client.Method1())
			CType(client, IChannel).Close()
			Console.ReadLine()
			service.Close()

		End Sub

		Public Shared Function GetBinding() As Binding
			Dim binding As New WSHttpBinding(SecurityMode.Message)
			binding.Security.Message.ClientCredentialType = MessageCredentialType.Windows
			Return binding
		End Function
	End Class
End Namespace

Nell'esempio seguente viene illustrato come specificare personalizzata.The following example shows how to specify Custom.

namespace CustomMode
{
    public class Test
    {
        public static void Main()
        {
            try
            {
                ShowPrincipalPermissionModeCustom ppwm = new ShowPrincipalPermissionModeCustom();
                ppwm.Run();

            }
            catch (Exception exc)
            {
                Console.WriteLine("Error: {0}", exc.Message);
                Console.ReadLine();
            }
        }
    }

    class ShowPrincipalPermissionModeCustom
    {
        [ServiceContract]
        interface ISecureService
        {
            [OperationContract]
            string Method1(string request);
        }

        [ServiceBehavior]
        class SecureService : ISecureService
        {
            [PrincipalPermission(SecurityAction.Demand, Role = "everyone")]
            public string Method1(string request)
            {
                return String.Format("Hello, \"{0}\"", Thread.CurrentPrincipal.Identity.Name);
            }
        }

        public void Run()
        {
            Uri serviceUri = new Uri(@"http://localhost:8006/Service");
            ServiceHost service = new ServiceHost(typeof(SecureService));
            service.AddServiceEndpoint(typeof(ISecureService), GetBinding(), serviceUri);
            List<IAuthorizationPolicy> policies = new List<IAuthorizationPolicy>();
            policies.Add(new CustomAuthorizationPolicy());
            service.Authorization.ExternalAuthorizationPolicies = policies.AsReadOnly();
            service.Authorization.PrincipalPermissionMode = PrincipalPermissionMode.Custom;
            service.Open();

            EndpointAddress sr = new EndpointAddress(
                serviceUri, EndpointIdentity.CreateUpnIdentity(WindowsIdentity.GetCurrent().Name));
            ChannelFactory<ISecureService> cf = new ChannelFactory<ISecureService>(GetBinding(), sr);
            ISecureService client = cf.CreateChannel();
            Console.WriteLine("Client received response from Method1: {0}", client.Method1("hello"));
            ((IChannel)client).Close();
            Console.ReadLine();
            service.Close();            
        }

        public static Binding GetBinding()
        {
            WSHttpBinding binding = new WSHttpBinding(SecurityMode.Message);
            binding.Security.Message.ClientCredentialType = MessageCredentialType.Windows;
            return binding;
        }

        class CustomAuthorizationPolicy : IAuthorizationPolicy
        {
            string id = Guid.NewGuid().ToString();

            public string Id
            {
                get { return this.id; }
            }

            public ClaimSet Issuer
            {
                get { return ClaimSet.System; }
            }

            public bool Evaluate(EvaluationContext context, ref object state)
            {
                object obj;
                if (!context.Properties.TryGetValue("Identities", out obj))
                    return false;

                IList<IIdentity> identities = obj as IList<IIdentity>;
                if (obj == null || identities.Count <= 0)
                    return false;

                context.Properties["Principal"] = new CustomPrincipal(identities[0]);
                return true;
            }
        }

        class CustomPrincipal : IPrincipal
        {
            IIdentity identity;
            public CustomPrincipal(IIdentity identity)
            {
                this.identity = identity;
            }

            public IIdentity Identity
            {
                get { return this.identity; }
            }

            public bool IsInRole(string role)
            {
                return true;
            }
        }
    }
}
Namespace CustomMode
	Public Class Test
		Public Shared Sub Main()
			Try
				Dim ppwm As New ShowPrincipalPermissionModeCustom()
				ppwm.Run()

			Catch exc As Exception
				Console.WriteLine("Error: {0}", exc.Message)
				Console.ReadLine()
			End Try
		End Sub
	End Class

	Friend Class ShowPrincipalPermissionModeCustom
		<ServiceContract> _
		Private Interface ISecureService
			<OperationContract> _
			Function Method1(ByVal request As String) As String
		End Interface

		<ServiceBehavior> _
		Private Class SecureService
			Implements ISecureService
            <PrincipalPermission(SecurityAction.Demand, Role:="everyone")> _
            Public Function Method1(ByVal request As String) As String Implements ISecureService.Method1
                Return String.Format("Hello, ""{0}""", Thread.CurrentPrincipal.Identity.Name)
            End Function
		End Class

		Public Sub Run()
			Dim serviceUri As New Uri("http://localhost:8006/Service")
			Dim service As New ServiceHost(GetType(SecureService))
			service.AddServiceEndpoint(GetType(ISecureService), GetBinding(), serviceUri)
			Dim policies As New List(Of IAuthorizationPolicy)()
			policies.Add(New CustomAuthorizationPolicy())
			service.Authorization.ExternalAuthorizationPolicies = policies.AsReadOnly()
			service.Authorization.PrincipalPermissionMode = PrincipalPermissionMode.Custom
			service.Open()

			Dim sr As New EndpointAddress(serviceUri, EndpointIdentity.CreateUpnIdentity(WindowsIdentity.GetCurrent().Name))
			Dim cf As New ChannelFactory(Of ISecureService)(GetBinding(), sr)
			Dim client As ISecureService = cf.CreateChannel()
			Console.WriteLine("Client received response from Method1: {0}", client.Method1("hello"))
			CType(client, IChannel).Close()
			Console.ReadLine()
			service.Close()
		End Sub

		Public Shared Function GetBinding() As Binding
			Dim binding As New WSHttpBinding(SecurityMode.Message)
			binding.Security.Message.ClientCredentialType = MessageCredentialType.Windows
			Return binding
		End Function

		Private Class CustomAuthorizationPolicy
			Implements IAuthorizationPolicy
			Private id_Renamed As String = Guid.NewGuid().ToString()

			Public ReadOnly Property Id() As String Implements System.IdentityModel.Policy.IAuthorizationComponent.Id
				Get
					Return Me.id_Renamed
				End Get
			End Property

			Public ReadOnly Property Issuer() As ClaimSet Implements IAuthorizationPolicy.Issuer
				Get
					Return ClaimSet.System
				End Get
			End Property

			Public Function Evaluate(ByVal context As EvaluationContext, ByRef state As Object) As Boolean Implements IAuthorizationPolicy.Evaluate
                Dim obj As Object = Nothing
				If (Not context.Properties.TryGetValue("Identities", obj)) Then
					Return False
				End If

				Dim identities As IList(Of IIdentity) = TryCast(obj, IList(Of IIdentity))
				If obj Is Nothing OrElse identities.Count <= 0 Then
					Return False
				End If

				context.Properties("Principal") = New CustomPrincipal(identities(0))
				Return True
			End Function
		End Class

		Private Class CustomPrincipal
			Implements IPrincipal
			Private identity_Renamed As IIdentity
			Public Sub New(ByVal identity As IIdentity)
				Me.identity_Renamed = identity
			End Sub

			Public ReadOnly Property Identity() As IIdentity Implements IPrincipal.Identity
				Get
					Return Me.identity_Renamed
				End Get
			End Property

			Public Function IsInRole(ByVal role As String) As Boolean Implements IPrincipal.IsInRole
				Return True
			End Function
		End Class
	End Class
End Namespace

Commenti

Quando viene applicata la classe PrincipalPermissionAttribute a un metodo, la presente modalità specifica quale set di ruoli utilizzare per l'autorizzazione dell'accesso.When applying the PrincipalPermissionAttribute to a method, this mode specifies which set of roles to use when authorizing access. Per impostazione predefinita, l'attributo utilizza gruppi di Windows (ad esempio Administrator o Users) per specificare il ruolo al quale è necessario che appartenga l'utente.By default, the attribute uses Windows groups (such as Administrator or Users) to specify the role to which the user must belong.

Per impostare la modalità a livello di programmazione, creare un'istanza della classe ServiceHost, quindi individuare la classe ServiceAuthorizationBehavior nella raccolta dei comportamenti corrispondente e impostare la proprietà PrincipalPermissionMode sull'enumerazione appropriata.To set the mode programmatically, create an instance of the ServiceHost class, then find the ServiceAuthorizationBehavior in its collection of behaviors, and set the PrincipalPermissionMode to the appropriate enumeration. Nell'esempio seguente imposta la proprietà UseAspNetRoles.The following example sets the property to UseAspNetRoles.

ServiceHost myServiceHost = new ServiceHost(typeof(Calculator), baseUri);
ServiceAuthorizationBehavior myServiceBehavior =
    myServiceHost.Description.Behaviors.Find<ServiceAuthorizationBehavior>();
myServiceBehavior.PrincipalPermissionMode =
    PrincipalPermissionMode.UseAspNetRoles;
Dim myServiceHost As New ServiceHost(GetType(Calculator), baseUri)
Dim myServiceBehavior As ServiceAuthorizationBehavior = myServiceHost.Description.Behaviors.Find(Of ServiceAuthorizationBehavior)()
myServiceBehavior.PrincipalPermissionMode = PrincipalPermissionMode.UseAspNetRoles

È anche possibile impostare il comportamento nella configurazione aggiungendo un <serviceAuthorization> per il <serviceBehaviors> di un file di configurazione, come illustrato nel codice seguente.You can also set the behavior in configuration by adding a <serviceAuthorization> to the <serviceBehaviors> of a configuration file, as shown in the following code.

// Only a client authenticated with a valid certificate that has the 
// specified subject name and thumbprint can call this method.
[PrincipalPermission(SecurityAction.Demand,
     Name = "CN=ReplaceWithSubjectName; 123456712345677E8E230FDE624F841B1CE9D41E")]
public double Multiply(double a, double b)
{
    return a * b;
}
' Only a client authenticated with a valid certificate that has the 
' specified subject name and thumbprint can call this method.
<PrincipalPermission(SecurityAction.Demand, Name := "CN=ReplaceWithSubjectName; 123456712345677E8E230FDE624F841B1CE9D41E")> _
Public Function Multiply(ByVal a As Double, ByVal b As Double) As Double
	Return a * b
End Function

L'enumerazione influisce su come l'attributo PrincipalPermissionAttribute assegna l'autorizzazione a un utente quando viene applicato a un metodo.The enumeration affects how the PrincipalPermissionAttribute attribute authorizes a user when it is applied to a method. L'esempio seguente applica l'attributo a un metodo e richiede che l'utente appartenga al gruppo Users del computer.The following example applies the attribute to a method and demands that the user belong to the Users group on the computer. Questo codice funziona solo se la proprietà PrincipalPermissionMode è impostata su UseWindowsGroup (impostazione predefinita).This code works only when the PrincipalPermissionMode is set to UseWindowsGroup (the default setting).

// Only members of the CalculatorClients group can call this method.
[PrincipalPermission(SecurityAction.Demand, Role = "Users")]
public double Add(double a, double b)
{
    return a + b;
}
' Only members of the CalculatorClients group can call this method.
<PrincipalPermission(SecurityAction.Demand, Role := "Users")> _
Public Function Add(ByVal a As Double, ByVal b As Double) As Double
	Return a + b
End Function

UseAspNetRolesUseAspNetRoles

Il valore UseAspNetRoles viene utilizzato per tutti i tipi di credenziali.The UseAspNetRoles value is used for all credential types. Questa modalità consente a Windows Communication Foundation (WCF) per usare il provider di ruoli ASP.NET per prendere decisioni di autorizzazione.This mode enables Windows Communication Foundation (WCF) to use the ASP.NET role provider to make authorization decisions.

Quando la credenziale di un servizio è un certificato X.509, è possibile impostare la proprietà Name della classe PrincipalPermissionAttribute su una stringa che è costituita dai valori concatenati del campo Oggetto e del campo Identificazione digitale, come illustrato nell'esempio seguente.When the credential for a service is an X.509 certificate, you can set the Name property of the PrincipalPermissionAttribute to a string that consists of the concatenated values of the Subject field and the Thumbprint field, as shown in the following example.

ServiceHost myServiceHost = new ServiceHost(typeof(Calculator), baseUri);
ServiceAuthorizationBehavior myServiceBehavior =
    myServiceHost.Description.Behaviors.Find<ServiceAuthorizationBehavior>();
myServiceBehavior.PrincipalPermissionMode =
    PrincipalPermissionMode.UseAspNetRoles;
MyServiceAuthorizationManager sm = new MyServiceAuthorizationManager();
myServiceBehavior.ServiceAuthorizationManager = sm;
Dim myServiceHost As New ServiceHost(GetType(Calculator), baseUri)
Dim myServiceBehavior As ServiceAuthorizationBehavior = myServiceHost.Description.Behaviors.Find(Of ServiceAuthorizationBehavior)()
myServiceBehavior.PrincipalPermissionMode = PrincipalPermissionMode.UseAspNetRoles
Dim sm As New MyServiceAuthorizationManager()
myServiceBehavior.ServiceAuthorizationManager = sm

La stringa concatenata è costituita dai valori dell'oggetto e dell'identificazione digitale separati da un punto e virgola e da uno spazio.The concatenated string consists of the subject and thumbprint values separated by a semicolon and a space.

È inoltre possibile il campo Oggetto di un certificato sia impostato su una stringa vuota.It is also possible for a certificate to have a Subject field set to a null string. In questo caso, è possibile impostare la proprietà Name su un punto e virgola seguito da un spazio e quindi dall'identificazione digitale, come illustrato nell'esempio seguente.In that case, you can set the Name property to a semicolon followed by a space and then the thumbprint, as shown in the following example.

// Only a client authenticated with a valid certificate that has the 
// specified thumbprint can call this method.
[PrincipalPermission(SecurityAction.Demand,
     Name = "; 123456712345677E8E230FDE624F841B1CE9D41E")]
public double Divide(double a, double b)
{
    return a * b;
}
' Only a client authenticated with a valid certificate that has the 
' specified thumbprint can call this method.
<PrincipalPermission(SecurityAction.Demand, Name := "; 123456712345677E8E230FDE624F841B1CE9D41E")> _
Public Function Divide(ByVal a As Double, ByVal b As Double) As Double
	Return a * b
End Function

Se un provider di ruoli ASP.NET è presente, è inoltre possibile impostare la proprietà Role su un ruolo nel database.If an ASP.NET role provider is present, you can also set the Role property to a role in the database. Per impostazione predefinita, il database è rappresentato dalla classe SqlRoleProvider.By default, the database is represented by the SqlRoleProvider. È inoltre possibile impostare un provider di ruoli personalizzato con la proprietà RoleProvider della classe ServiceAuthorizationBehavior.You can also set a custom role provider with the RoleProvider property of the ServiceAuthorizationBehavior class. Il codice seguente consente di impostare il ruolo su Administrators.The following code sets the role to Administrators. Si noti che è necessario che il provider di ruoli esegua il mapping dell'account utente a quel ruolo.Note that the role provider must map the user account to that role.

[PrincipalPermission(SecurityAction.Demand, Role = "Administrators")]
public string ReadFile(string fileName)
{
    // Code not shown.
    return "Not implemented";
}
<PrincipalPermission(SecurityAction.Demand, Role := "Administrators")> _
Public Function ReadFile(ByVal fileName As String) As String
	' Code not shown.
	Return "Not implemented"
End Function

Per altre informazioni sul provider di ruoli ASP.NET, vedere How To: utilizzo di gestione ruoli in ASP.NET 2.0.For more information about the ASP.NET Role provider, see How To: Use Role Manager in ASP.NET 2.0.

Per altre informazioni sull'utilizzo di WCF e il provider di ruoli, vedere procedura: usare il Provider di ruoli ASP.NET con un servizio.For more information about using WCF and the role provider, see How to: Use the ASP.NET Role Provider with a Service.

Custom (Personalizzati)Custom

Quando la proprietà è impostata su Custom, è necessario fornire anche una classe personalizzata che implementa il IAuthorizationPolicy classe.When the property is set to Custom, you must also provide a custom class that implements the IAuthorizationPolicy class. Questa classe ha lo scopo di fornire la rappresentazione del chiamante IPrincipal all'interno della raccolta Properties.This class is responsible for providing the caller's IPrincipal representation inside the Properties collection. È necessario che l'istanza IPrincipal venga memorizzata nella raccolta delle proprietà utilizzando la chiave stringa "Principal", come illustrato nell'esempio seguente.It must store the IPrincipal instance to the properties collection using the "Principal" string key, as shown in the following example.

evaluationContext.Properties["Principal"]=new CustomPrincipal(identity);  

SfondoBackground

La sicurezza basata sui ruoli di .NET Framework.NET Framework consente alle applicazioni di specificare le autorizzazioni tramite il codice.The role-based security in .NET Framework.NET Framework enables applications to specify authorizations through code. Specificando la richiesta PrincipalPermission, la proprietà CurrentPrincipal deve soddisfare il requisito PrincipalPermission.By specifying the PrincipalPermission demand, the CurrentPrincipal must satisfy the PrincipalPermission requirement. Ad esempio, è necessario che l'utente faccia parte di un ruolo o un gruppo specifico For example, that the user must be in a specific role or group. In caso contrario, il thread non viene autorizzato a eseguire il codice e viene generata un'eccezione.Otherwise, the thread is not authorized to execute the code, which results in an exception. WCF fornisce un set di PrincipalPermissionMode selezioni per specificare il CurrentPrincipal base SecurityContext conseguenza.WCF provides a set of PrincipalPermissionMode selections to specify the CurrentPrincipal based on SecurityContext accordingly.

Si applica a