Ersetzen eines Principalobjekts
Anwendungen, die Authentifizierungsdienste bereitstellen, müssen das Principal -Objekt (IPrincipal) für einen vorhandenen Thread ersetzen können. Zusätzlich muss das Sicherheitssystem Schutz für ein Ersetzen von Principal -Objekten bieten, weil ein in böswilliger Absicht zugewiesenes falsches Principal -Objekt die Sicherheit der Anwendung durch Angabe einer falschen Identität oder Rolle beeinträchtigt. Daher muss Anwendungen, die in der Lage sind, Principal -Objekte zu ersetzen, das System.Security.Permissions.SecurityPermission -Objekt gewährt werden, damit Prinzipale gesteuert werden können. (Beachten Sie, dass diese Berechtigung nicht dazu erforderlich ist, rollenbasierte Sicherheitsüberprüfungen auszuführen oder Principal -Objekte zu erstellen.)
Das aktuelle Principal -Objekt kann ersetzt werden, indem die folgenden Schritte ausgeführt werden:
Erstellen Sie das ersetzende Principal -Objekt und das zugeordnete Identity -Objekt.
Ordnen Sie das neue Principal -Objekt dem Aufrufkontext zu.
Beispiel
Im folgenden Beispiel wird veranschaulicht, wie ein allgemeines Principal-Objekt erstellt und dann dazu verwendet wird, den Prinzipal eines Threads festzulegen.
using System;
using System.Threading;
using System.Security.Permissions;
using System.Security.Principal;
class SecurityPrincipalDemo
{
public static void Main()
{
// Retrieve a GenericPrincipal that is based on the current user's
// WindowsIdentity.
GenericPrincipal genericPrincipal = GetGenericPrincipal();
// Retrieve the generic identity of the GenericPrincipal object.
GenericIdentity principalIdentity =
(GenericIdentity)genericPrincipal.Identity;
// Display the identity name and authentication type.
if (principalIdentity.IsAuthenticated)
{
Console.WriteLine(principalIdentity.Name);
Console.WriteLine("Type:" + principalIdentity.AuthenticationType);
}
// Verify that the generic principal has been assigned the
// NetworkUser role.
if (genericPrincipal.IsInRole("NetworkUser"))
{
Console.WriteLine("User belongs to the NetworkUser role.");
}
Thread.CurrentPrincipal = genericPrincipal;
}
// Create a generic principal based on values from the current
// WindowsIdentity.
private static GenericPrincipal GetGenericPrincipal()
{
// Use values from the current WindowsIdentity to construct
// a set of GenericPrincipal roles.
WindowsIdentity windowsIdentity = WindowsIdentity.GetCurrent();
string[] roles = new string[10];
if (windowsIdentity.IsAuthenticated)
{
// Add custom NetworkUser role.
roles[0] = "NetworkUser";
}
if (windowsIdentity.IsGuest)
{
// Add custom GuestUser role.
roles[1] = "GuestUser";
}
if (windowsIdentity.IsSystem)
{
// Add custom SystemUser role.
roles[2] = "SystemUser";
}
// Construct a GenericIdentity object based on the current Windows
// identity name and authentication type.
string authenticationType = windowsIdentity.AuthenticationType!;
string userName = windowsIdentity.Name;
GenericIdentity genericIdentity =
new GenericIdentity(userName, authenticationType);
// Construct a GenericPrincipal object based on the generic identity
// and custom roles for the user.
GenericPrincipal genericPrincipal =
new GenericPrincipal(genericIdentity, roles);
return genericPrincipal;
}
}
Imports System.Threading
Imports System.Security.Permissions
Imports System.Security.Principal
Class SecurityPrincipalDemo
' Create a generic principal based on values from the current
' WindowsIdentity.
Private Shared Function GetGenericPrincipal() As GenericPrincipal
' Use values from the current WindowsIdentity to construct
' a set of GenericPrincipal roles.
Dim windowsIdentity As WindowsIdentity = windowsIdentity.GetCurrent()
Dim roles(9) As String
If windowsIdentity.IsAuthenticated Then
' Add custom NetworkUser role.
roles(0) = "NetworkUser"
End If
If windowsIdentity.IsGuest Then
' Add custom GuestUser role.
roles(1) = "GuestUser"
End If
If windowsIdentity.IsSystem Then
' Add custom SystemUser role.
roles(2) = "SystemUser"
End If
' Construct a GenericIdentity object based on the current Windows
' identity name and authentication type.
Dim authenticationType As String = windowsIdentity.AuthenticationType
Dim userName As String = windowsIdentity.Name
Dim genericIdentity As New GenericIdentity(userName, authenticationType)
' Construct a GenericPrincipal object based on the generic identity
' and custom roles for the user.
Dim genericPrincipal As New GenericPrincipal(genericIdentity, roles)
Return genericPrincipal
End Function 'GetGenericPrincipal
Public Shared Sub Main()
' Retrieve a GenericPrincipal that is based on the current user's
' WindowsIdentity.
Dim genericPrincipal As GenericPrincipal = GetGenericPrincipal()
' Retrieve the generic identity of the GenericPrincipal object.
Dim principalIdentity As GenericIdentity = CType(genericPrincipal.Identity, GenericIdentity)
' Display the identity name and authentication type.
If principalIdentity.IsAuthenticated Then
Console.WriteLine(principalIdentity.Name)
Console.WriteLine("Type:" + principalIdentity.AuthenticationType)
End If
' Verify that the generic principal has been assigned the
' NetworkUser role.
If genericPrincipal.IsInRole("NetworkUser") Then
Console.WriteLine("User belongs to the NetworkUser role.")
End If
Thread.CurrentPrincipal = genericPrincipal
End Sub
End Class
