1

I have a system that is multi-homed, that is, our customers share a database. Using MVC Routing, I can pass the customer name as the first portion of the domain ({customer}.server.tld), and have it translated into a parameter to my controller actions.

Problems include:

Authorization: how can I do this transparently, so that developers making controller actions don't have to remember to do this, and someone not authorized will automatically receive a 403 if they are not authorized to view a particular customer?

Parameter passing: I don't want for every controller action to have a parameter called "customerId". The data has GUID primary keys, so customerId isn't required at the data access level.

What should I do here? I don't want a user changing the URL and getting access to all of our customers' data!

Chris McCall
  • 10,317
  • 8
  • 49
  • 80

1 Answers1

0

Have you considered using Windows Identity Foundation (WIF)? May sound like an overkill, but it will allow you to not only separate AuthN from AuthZ, but also have code logic (in one spot!) where you can check each customer claim (maybe based on route data) and act accordingly...Check out some of these links:

Community
  • 1
  • 1
zam6ak
  • 7,229
  • 11
  • 46
  • 84