链接CanExecute命令方法和授权管理

Question

I want to manage permissions to execute commands and view controls and so on. Therefore I have a class UserAction implementing ICommand interface.

I want to define UserActions available for the UserManagement using one Enum.

For simplifying UserManagement I want to wrap multiple UserActions to UserActivities which permissions are set in a database table.

On runtime I have a Role class which maintains the currently set of permissions (stored as UserActivities), these permissions are likely to change during runtime.

Does anyone know how to manage this CanExecute methods correctly or are there any nice patterns or frameworks meant for this topic?

I did not find a lot about this for now on the net.

Answer 1

As a whole what you want to achieve is called externalized authorization management . You can consider two different approaches:

1. Microsoft provides something called claims-based authorization. You can find lots of tutorials on the topic online. Here's a great article from 2013 .
2. You can also fully externalize (and standardize) your authorization by using XACML, the eXtensible Access Control Markup Language which is both an authorization framework as well as a policy language to define your authorization policies. Unfortunately .NET doesn't have XACML built-in so you need to add in an external authorization engine (also called policy decision point or PDP). There are a couple available from Axiomatics or XEngine (on sourceforge).