ServiceAuthorizationManager Class

Reference

Definition

Namespace:: System.ServiceModel

Assembly:: System.ServiceModel.dll

Important

Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

Provides authorization access checking for service operations.

public ref class ServiceAuthorizationManager

public class ServiceAuthorizationManager

type ServiceAuthorizationManager = class

Public Class ServiceAuthorizationManager

Inheritance: Object
ServiceAuthorizationManager

Examples

The following example shows a class named MyServiceAuthorizationManager that inherits from the ServiceAuthorizationManager and overrides the CheckAccessCore method.

public class MyServiceAuthorizationManager : ServiceAuthorizationManager
{
  protected override bool CheckAccessCore(OperationContext operationContext)
  {
    // Extract the action URI from the OperationContext. Match this against the claims
    // in the AuthorizationContext.
    string action = operationContext.RequestContext.RequestMessage.Headers.Action;
  
    // Iterate through the various claim sets in the AuthorizationContext.
    foreach(ClaimSet cs in operationContext.ServiceSecurityContext.AuthorizationContext.ClaimSets)
    {
      // Examine only those claim sets issued by System.
      if (cs.Issuer == ClaimSet.System)
      {
        // Iterate through claims of type "http://www.contoso.com/claims/allowedoperation".
          foreach (Claim c in cs.FindClaims("http://www.contoso.com/claims/allowedoperation", Rights.PossessProperty))
        {
          // If the Claim resource matches the action URI then return true to allow access.
          if (action == c.Resource.ToString())
            return true;
        }
      }
    }
  
    // If this point is reached, return false to deny access.
    return false;
  }
}


Public Class MyServiceAuthorizationManager
    Inherits ServiceAuthorizationManager
    
    Protected Overrides Function CheckAccessCore(ByVal operationContext As OperationContext) As Boolean 
        ' Extract the action URI from the OperationContext. Match this against the claims.
        ' in the AuthorizationContext.
        Dim action As String = operationContext.RequestContext.RequestMessage.Headers.Action
        
        ' Iterate through the various claimsets in the AuthorizationContext.
        Dim cs As ClaimSet
        For Each cs In  operationContext.ServiceSecurityContext.AuthorizationContext.ClaimSets
            ' Examine only those claim sets issued by System.
            If cs.Issuer Is ClaimSet.System Then
                ' Iterate through claims of type "http://www.contoso.com/claims/allowedoperation".
                Dim c As Claim
                For Each c In  cs.FindClaims("http://www.contoso.com/claims/allowedoperation", _
                     Rights.PossessProperty)
                    ' If the Claim resource matches the action URI then return true to allow access.
                    If action = c.Resource.ToString() Then
                        Return True
                    End If
                Next c
            End If
        Next cs 
        ' If this point is reached, return false to deny access.
        Return False
    
    End Function 
End Class

Remarks

This class is responsible for evaluating all policies (rules that define what a user is allowed to do), comparing the policies to claims made by a client, setting the resulting AuthorizationContext to the ServiceSecurityContext, and providing the authorization decision whether to allow or deny access for a given service operation for a caller.

The CheckAccessCore method is called by the Windows Communication Foundation (WCF) infrastructure each time an attempt to access a resource is made. The method returns true or false to allow or deny access, respectively.

The ServiceAuthorizationManager is part of the WCFIdentity Model infrastructure. The Identity Model enables you to create custom authorization policies and custom authorization schemes. For more information about how the Identity Model works, see Managing Claims and Authorization with the Identity Model.

Custom Authorization

This class does not perform any authorization and allows users to access all service operations. To provide more restrictive authorization, you must create a custom authorization manager that checks custom policies. To do this, inherit from this class and override the CheckAccessCore method. Specify the instance of the derived class through the ServiceAuthorizationManager property.

In CheckAccessCore, the application can use the OperationContext object to access the caller identity (ServiceSecurityContext).

By getting the IncomingMessageHeaders property, which returns a MessageHeaders object, the application can access the service (To), and the operation (Action).

By getting the RequestContext property, which returns a RequestContext object, the application can access the entire request message (RequestMessage) and perform the authorization decision accordingly.

For an example, see How to: Create a Custom Authorization Manager for a Service.

To create custom authorization policies, implement the IAuthorizationPolicy class. For an example, see How to: Create a Custom Authorization Policy.

To create a custom claim, use the Claim class. For an example, see How to: Create a Custom Claim. To compare custom claims, you must compare claims, as shown in How to: Compare Claims.

For more information, see Custom Authorization.

You can set the type of a custom authorization manager using the <serviceAuthorization> in a client application configuration file.

Constructors

ServiceAuthorizationManager()

Initializes a new instance of the ServiceAuthorizationManager class.

Methods

CheckAccess(OperationContext)	Checks authorization for the given operation context.
CheckAccess(OperationContext, Message)	Checks authorization for the given operation context when access to a message is required.
CheckAccessCore(OperationContext)	Checks authorization for the given operation context based on default policy evaluation.
Equals(Object)	Determines whether the specified object is equal to the current object. (Inherited from Object)
GetAuthorizationPolicies(OperationContext)	Gets the set of policies that participate in policy evaluation.
GetHashCode()	Serves as the default hash function. (Inherited from Object)
GetType()	Gets the Type of the current instance. (Inherited from Object)
MemberwiseClone()	Creates a shallow copy of the current Object. (Inherited from Object)
ToString()	Returns a string that represents the current object. (Inherited from Object)

Applies to