From 45b0fe42a979d444d547a5248eb2e9e915aaf16a Mon Sep 17 00:00:00 2001 From: wei <> Date: Sun, 14 Jan 2007 02:10:24 +0000 Subject: Add "block-content" to allow user comments on block level elements in quickstart docs. --- .../quickstart/protected/pages/Advanced/Auth.page | 38 +++++++++++----------- 1 file changed, 19 insertions(+), 19 deletions(-) (limited to 'demos/quickstart/protected/pages/Advanced/Auth.page') diff --git a/demos/quickstart/protected/pages/Advanced/Auth.page b/demos/quickstart/protected/pages/Advanced/Auth.page index 3373644a..45f6ea0b 100644 --- a/demos/quickstart/protected/pages/Advanced/Auth.page +++ b/demos/quickstart/protected/pages/Advanced/Auth.page @@ -1,29 +1,29 @@

Authentication and Authorization

-

+

Authentication is a process of verifying whether someone is who he claims he is. It usually involves a username and a password, but may include any other methods of demonstrating identity, such as a smart card, fingerprints, etc.

-

+

Authorization is finding out if the person, once identified, is permitted to manipulate specific resources. This is usually determined by finding out if that person is of a particular role that has access to the resources.

How PRADO Auth Framework Works

-

+

PRADO provides an extensible authentication/authorization framework. As described in application lifecycles, TApplication reserves several lifecycles for modules responsible for authentication and authorization. PRADO provides the TAuthManager module for such purposes. Developers can plug in their own auth modules easily. TAuthManager is designed to be used together with TUserManager module, which implements a read-only user database.

-

+

When a page request occurs, TAuthManager will try to restore user information from session. If no user information is found, the user is considered as an anonymous or guest user. To facilitate user identity verification, TAuthManager provides two commonly used methods: login() and logout(). A user is logged in (verified) if his username and password entries match a record in the user database managed by TUserManager. A user is logged out if his user information is cleared from session and he needs to re-login if he makes new page requests.

-

+

During Authorization application lifecycle, which occurs after Authentication lifecycle, TAuthManager will verify if the current user has access to the requested page according to a set of authorization rules. The authorization is role-based, i.e., a user has access to a page if 1) the page explicitly states that the user has access; 2) or the user is of a particular role that has access to the page. If the user does not have access to the page, TAuthManager will redirect user browser to the login page which is specified by LoginPage property.

Using PRADO Auth Framework

-

+

To enable PRADO auth framework, add the TAuthManager module and TUserManager module to application configuration,

- + <service id="page" class="TPageService"> <modules> <module id="auth" class="System.Security.TAuthManager" @@ -36,13 +36,13 @@ To enable PRADO auth framework, add the TAuthManager module and TUs </modules> </service> -

+

In the above, the UserManager property of TAuthManager is set to the users module which is TUserManager. Developers may replace it with a different user management module that is derived from TUserManager.

-

+

Authorization rules for pages are specified in page configurations as follows,

- + <authorization> <allow pages="PageID1,PageID2" users="User1,User2" @@ -52,41 +52,41 @@ Authorization rules for pages are specified in -

+

An authorization rule can be either an allow rule or a deny rule. Each rule consists of four optional properties:

-
    +
    • pages - list of comma-separated page names that this rule applies to. If empty or not set, this rule will apply to all pages under the current directory and all its subdirectories recursively.
    • users - list of comma-separated user names that this rule applies to. A character * refers to all users including anonymous/guest user. And a character ? refers to anonymous/guest user.
    • roles - list of comma-separated user roles that this rule applies to.
    • verb - page access method that this rule applies to. It can be either get or post. If empty or not set, the rule applies to both methods.
    -

    +

    When a page request is being processed, a list of authorization rules may be available. However, only the first effective rule matching the current user will render the authorization result.

    -
      +
      • Rules are ordered bottom-up, i.e., the rules contained in the configuration of current page folder go first. Rules in configurations of parent page folders go after.
      • A rule is effective if the current page is in the listed pages of the rule AND the current user action (get or post) is in the listed actions.
      • A rule matching occurs if the current user name is in the listed user names of an effective rule OR if the user's role is in the listed roles of that rule.
      • If no rule matches, the user is authorized.
      -

      +

      In the above example, anonymous users will be denied from posting to PageID1 and PageID2, while User1 and User2 and all users of role Role1 can access the two pages (in both get and post methods).

      Using TUserManager

      -

      +

      As aforementioned, TUserManager implements a read-only user database. The user information are specified in either application configuration or an external XML file.

      -

      +

      We have seen in the above example that two users are specified in the application configuration. Complete syntax of specifying the user and role information is as follows,

      - + <user name="demo" password="demo" roles="demo,admin" /> <role name="admin" users="demo,demo2" /> -

      +

      where the roles attribute in user element is optional. User roles can be specified in either the user element or in a separate role element.

      \ No newline at end of file -- cgit v1.2.3