Basing Authorization on the Message Body

How do I use a field in the message to answer an authorization request in ServiceAuthorizationManager?

There are two ways to go about doing this. The first makes use of a new feature in Orcas while the other is potentially more flexible and definitely requires more work.

There’s a new overload for CheckAccess in ServiceAuthorizationManager that gives you a Message instance for the current request. This allows you to access the body contents by reading the message. Reading the message consumes it so you’ll need to replace the message when you’re done. You should be aware that this is going to be a significant speed bump unless you were already buffering messages. Even so, touching the body contents is almost guaranteed to take noticeably longer than you’re used to for performing authorization checks.

 public virtual bool CheckAccess(OperationContext operationContext, ref Message message);

The other option is to insert a transformation step prior to ServiceAuthorizationManager being invoked. The transformation step takes the contents of the message and extracts the information needed for the authorization decision into a message header or property. This allows you to use ServiceAuthorizationManager exactly as before. Adding the transformation is a lot harder than overriding a method but you can potentially be doing other protocol work at the same time that also uses the contents of the message. You may be able to amortize some of the overhead of touching the message body in this way although in the worst case you’re no better off than with CheckAccess.

Next time: Demanding Permissions

Comments

• Anonymous
  January 08, 2008
  How do I clean up resources on the server when a duplex client closes its half of the connection? Duplex

• Anonymous
  April 29, 2008
  Continuing on with the theme of messaging additions in Orcas, today I'll look at some more of the protocols