private bool IsValidAccess(string domainOfAccess, string privilegeLevel, string userIdentifier)
{
ResultCode result;
//NOTE: if this class in the platform appdomain then the platform has no reference to ModuleBase and hence Module Friendly Name
// Hence we construct "module friendly name" (e.g., GuiWeb, scouts) by looking at the base addresses of the service host
string accessedModuleName = safeServiceHost.BaseAddresses()[0].LocalPath.Split('/').ElementAt(2);
result = (ResultCode)consumer.IsValidAccess(accessedModuleName, domainOfAccess, privilegeLevel, userIdentifier);
if (result == ResultCode.InSufficientPrivilege)
{
ThrowRejection(HttpStatusCode.Unauthorized, "Insufficient privilege of given token.");
}
if (result == ResultCode.InvalidUser)
{
ThrowRejection(HttpStatusCode.Forbidden, "User access for given user not authorized.");
}
if (result == ResultCode.ForbiddenAccess)
{
ThrowRejection(HttpStatusCode.Forbidden, "User access forbidden by policy.");
}
if (result == ResultCode.Allow)
{
return(true);
}
return(false);
}
public SafeServiceAuthorizationManager(SafeServicePolicyDecider consumer, SafeServiceHost safeServiceHost)
: base()
{
hostTokenResultCache = new Dictionary <string, Dictionary <DateTime, bool> >();
this.consumer = consumer;
this.safeServiceHost = safeServiceHost;
this.enforcePolicies = true;
// stub to check if policies are not to be enforced
// Assumption: if the policy is to allow every user from every domain access to every module => EnforcePolicies = false
string accessedModuleName = safeServiceHost.BaseAddresses()[0].LocalPath.Split('/').ElementAt(2);
if ((ResultCode)consumer.IsValidAccess(accessedModuleName, "*", "*", "*") == ResultCode.Allow)
{
this.enforcePolicies = false;
}
}
public SafeServiceAuthorizationManager(SafeServicePolicyDecider consumer, SafeServiceHost safeServiceHost)
: base()
{
hostTokenResultCache = new Dictionary<string, Dictionary<DateTime,bool>>();
this.consumer = consumer;
this.safeServiceHost = safeServiceHost;
this.enforcePolicies = true;
// stub to check if policies are not to be enforced
// Assumption: if the policy is to allow every user from every domain access to every module => EnforcePolicies = false
string accessedModuleName = safeServiceHost.BaseAddresses()[0].LocalPath.Split('/').ElementAt(2);
if ((ResultCode)consumer.IsValidAccess(accessedModuleName, "*", "*", "*") == ResultCode.Allow)
this.enforcePolicies = false;
}