Is there a C# library that behaves like Active Directory's Permissions and Groups?

Question

I like the way permissions and groups work in Active Directory, but I don't want to actually tie my application in with AD.

Is there an existing library out there that contains the same sort of functionality that AD has? In particular, the ability to create groups, assign users to groups, add permissions to groups, and view a user or group's applied permissions?

What about the Provider model that already exists? http://msdn.microsoft.com/en-us/library/kt5ssstk.aspx — Charlie Brown, May 16 '11 at 14:42
@Charlie Thanks, but I am looking to manage business rules, not just handle authorization. — Rachel, May 16 '11 at 15:49
I see, I have used the RoleProvider in the past to do this, then mark methods in the service layer with attributes to require specific roles to execute. You can also mark visible props in the viewmodel to show or hide. — Charlie Brown, May 16 '11 at 17:36

score 1 · Answer 1 · answered Jun 15 '12 at 04:41

The ActiveDirectoryMembershipProvider class inherits MembershipProvider.

That means that you don't have to tie your application to AD per se, but to the MembershipProvider model. This model is used throughout .net and works well with built in controls and classes.

Here is a sample

//Any of these will work
ActiveDirectoryMembershipProvider provider = new ActiveDirectoryMembershipProvider();
//SqlMembershipProvider provider = new SqlMembershipProvider();
//MyCustomMemebershipProvider provider = new MyCustomMemebershipProvider();

MembershipProvider membershipProvider = provider;

if (membershipProvider.ValidateUser("username", "password"))
{
    MembershipUser user = membershipProvider.GetUser("username", true);
}
else
{
    //Do something
}

I am no expert on this model, but have had some experience sub classing MembershipProvider and implementing IPrincipal, IIdentity etc. Doing this is really flexible and maintains a consistent architecture

score 1 · Answer 2 · answered May 16 '11 at 14:07

May be you can use Microsoft-s AzMan-Authorization Manager as a wrapper for Active directory.

It contains an API to program against to ask for permissions

and a gui (azman.msc) where you can define roles and map rights and store them in an xml-file.

It can be configured against Active Directory.

score 0 · Answer 3 · answered May 15 '12 at 11:47

0

You can use Authorization Manager (AzMan) for this, its part of Windows Server. To integrate with it from .NET, Enterprize Library 5 has class library types for it you can use.

answered May 15 '12 at 11:47

Mahol25

3,131
2
22
20

score 0 · Answer 4 · answered May 16 '11 at 13:47

You can setup a free LDAP server, e.g. OpenLDAP, and use DirectoryServices to access it, and any number of tools to administrate the LDAP directory. Some configuration required!

The advantage to using a standard directory service is in the plethora of administration tools and the ability to support any number of applications. The disadvantages is in learning to administrate and query the directory. Is there any particular reason you don't want to use AD? If you're working on Windows, I'd strongly recommend it over most objections.

score 0 · Answer 5 · edited May 23 '17 at 10:09

0

If AD is too heavy for you, you can use ADAM which is a light AD, that you can configure with ADSI Edit provided with the latter. Here is a good doc provided, and configuration question on SO.

Moreover you can browse ADAM with the same kind of .NET APIs (System.DirectoryServices.AccountManagement for instance).

edited May 23 '17 at 10:09

Community

1
1

answered May 16 '11 at 13:48

Emmanuel

13,935
12
50
72

score 0 · Answer 6 · edited Jun 20 '20 at 09:12

Two things.

First :

If you want to interact with a Directory you have to program on the top of LDAP APIs. As far as I undestand ADSI is working on the top of LDAP, but it does not seem to be so independant of Active Directory. I know that Novell who initiate the mono project edit a more independant C# library on the top of LDAP.

Second :

Permissions, I mean Access Control List (ACLs) are a non standard feature. The way permissions are implemented in Active directory, is different from the way they are implemented in Sun e-Directory (special attributes). For example in OpenLDAP permissions are implented in a kind of access filter.

I may (hope to) be wrong, but I never heard about a library that federate permission in Directories.

score 0 · Answer 7 · answered May 17 '11 at 19:19

0

One library that I have read about is Rhino Security. It seems to handle authentication as well as authorization for business operations, and is probably worth a look. I have not actually implemented it though, so I do not know how well it works.

answered May 17 '11 at 19:19

KallDrexx

27,229
33
143
254

Is there a C# library that behaves like Active Directory's Permissions and Groups?

7 Answers7