[Sommaire] [Imprimer]

   1  <com:TContent ID="body" >
   2  
   3  <h1 id="5501">Authentication and Authorization</h1>
   4  <p>
   5  Authentication is a process of verifying whether someone is who he claims he is. It usually involves a username and a password, but may include any other methods of demonstrating identity, such as a smart card, fingerprints, etc.
   6  </p>
   7  <p>
   8  Authorization is finding out if the person, once identified, is permitted to manipulate specific resources. This is usually determined by finding out if that person is of a particular role that has access to the resources.
   9  </p>
  10  
  11  <h2 id="5502">How PRADO Auth Framework Works</h2>
  12  <p>
  13  PRADO provides an extensible authentication/authorization framework. As described in <a href="?page=Fundamentals.Applications">application lifecycles</a>, <tt>TApplication</tt> reserves several lifecycles for modules responsible for authentication and authorization. PRADO provides the <tt>TAuthManager</tt> module for such purposes. Developers can plug in their own auth modules easily. <tt>TAuthManager</tt> is designed to be used together with <tt>TUserManager</tt> module, which implements a read-only user database.
  14  </p>
  15  <p>
  16  When a page request occurs, <tt>TAuthManager</tt> will try to restore user information from session. If no user information is found, the user is considered as an anonymous or guest user. To facilitate user identity verification, <tt>TAuthManager</tt> provides two commonly used methods: <tt>login()</tt> and <tt>logout()</tt>. A user is logged in (verified) if his username and password entries match a record in the user database managed by <tt>TUserManager</tt>. A user is logged out if his user information is cleared from session and he needs to re-login if he makes new page requests.
  17  </p>
  18  <p>
  19  During <tt>Authorization</tt> application lifecycle, which occurs after <tt>Authentication</tt> lifecycle, <tt>TAuthManager</tt> will verify if the current user has access to the requested page according to a set of authorization rules. The authorization is role-based, i.e., a user has access to a page if 1) the page explicitly states that the user has access; 2) or the user is of a particular role that has access to the page. If the user does not have access to the page, <tt>TAuthManager</tt> will redirect user browser to the login page which is specified by <tt>LoginPage</tt> property.
  20  </p>
  21  
  22  <h2 id="5503">Using PRADO Auth Framework</h2>
  23  <p>
  24  To enable PRADO auth framework, add the <tt>TAuthManager</tt> module and <tt>TUserManager</tt> module to <a href="?page=Configurations.AppConfig">application configuration</a>,
  25  </p>
  26  <com:TTextHighlighter Language="xml" CssClass="source">
  27  &lt;service id="page" class="TPageService"&gt;
  28    &lt;modules&gt;
  29      &lt;module id="auth" class="System.Security.TAuthManager"
  30                 UserManager="users" LoginPage="UserLogin" /&gt;
  31      &lt;module id="users" class="System.Security.TUserManager"
  32                 PasswordMode="Clear"&gt;
  33        &lt;user name="demo" password="demo" /&gt;
  34        &lt;user name="admin" password="admin" /&gt;
  35      &lt;/module&gt;
  36    &lt;/modules&gt;
  37  &lt;/service&gt;
  38  </com:TTextHighlighter>
  39  <p>
  40  In the above, the <tt>UserManager</tt> property of <tt>TAuthManager</tt> is set to the <tt>users</tt> module which is <tt>TUserManager</tt>. Developers may replace it with a different user management module that is derived from <tt>TUserManager</tt>.
  41  </p>
  42  <p>
  43  Authorization rules for pages are specified in <a href="?page=Configurations.PageConfig">page configurations</a> as follows,
  44  </p>
  45  <com:TTextHighlighter Language="xml" CssClass="source">
  46  &lt;authorization&gt;
  47      &lt;allow pages="PageID1,PageID2"
  48                users="User1,User2"
  49                roles="Role1" /&gt;
  50      &lt;deny pages="PageID1,PageID2"
  51                users="?"
  52                verb="post" /&gt;
  53  &lt;/authorization&gt;
  54  </com:TTextHighlighter>
  55  <p>
  56  An authorization rule can be either an <tt>allow</tt> rule or a <tt>deny</tt> rule. Each rule consists of four optional properties:
  57  </p>
  58  <ul>
  59  <li><tt>pages</tt> - list of comma-separated page names that this rule applies to. If empty or not set, this rule will apply to all pages under the current directory and all its subdirectories recursively.</li>
  60  <li><tt>users</tt> - list of comma-separated user names that this rule applies to. A character * refers to all users including anonymous/guest user. And a character ? refers to anonymous/guest user.</li>
  61  <li><tt>roles</tt> - list of comma-separated user roles that this rule applies to.</li>
  62  <li><tt>verb</tt> - page access method that this rule applies to. It can be either <tt>get</tt> or <tt>post</tt>. If empty or not set, the rule applies to both methods.</li>
  63  </ul>
  64  
  65  <p>
  66  When a page request is being processed, a list of authorization rules may be available. However, only the <i>first effective</i> rule <i>matching</i> the current user will render the authorization result.
  67  </p>
  68  <ul>
  69  <li>Rules are ordered bottom-up, i.e., the rules contained in the configuration of current page folder go first. Rules in configurations of parent page folders go after.</li>
  70  <li>A rule is effective if the current page is in the listed pages of the rule AND the current user action (<tt>get</tt> or <tt>post</tt>) is in the listed actions.</li>
  71  <li>A rule matching occurs if the current user name is in the listed user names of an <i>effective</i> rule OR if the user's role is in the listed roles of that rule.</li>
  72  <li>If no rule matches, the user is authorized.</li>
  73  </ul>
  74  <p>
  75  In the above example, anonymous users will be denied from posting to <tt>PageID1</tt> and <tt>PageID2</tt>, while <tt>User1</tt> and <tt>User2</tt> and all users of role <tt>Role1</tt> can access the two pages (in both <tt>get</tt> and <tt>post</tt> methods).
  76  </p>
  77  
  78  <h2 id="5504">Using <tt>TUserManager</tt></h2>
  79  <p>
  80  As aforementioned, <tt>TUserManager</tt> implements a read-only user database. The user information are specified in either application configuration or an external XML file.
  81  </p>
  82  <p>
  83  We have seen in the above example that two users are specified in the application configuration. Complete syntax of specifying the user and role information is as follows,
  84  </p>
  85  <com:TTextHighlighter Language="xml" CssClass="source">
  86  &lt;user name="demo" password="demo" roles="demo,admin" /&gt;
  87  &lt;role name="admin" users="demo,demo2" /&gt;
  88  </com:TTextHighlighter>
  89  <p>
  90  where the <tt>roles</tt> attribute in <tt>user</tt> element is optional. User roles can be specified in either the <tt>user</tt> element or in a separate <tt>role</tt> element.
  91  </p>
  92  </com:TContent>