This documentation is archived and is not being maintained.

PrincipalPermissionMode Enumeration

Sets the mode for authorization checks when using the PrincipalPermissionAttribute to control access to a method.

Namespace:  System.ServiceModel.Description
Assembly:  System.ServiceModel (in System.ServiceModel.dll)

public enum class PrincipalPermissionMode

Member nameDescription
NoneCurrentPrincipal is not set.
UseWindowsGroupsCurrentPrincipal is set based on Windows (WindowsPrincipal). If the user identity is not associated with a Windows account, anonymous Windows is used.
UseAspNetRolesCurrentPrincipal is set based on the ASP.NET role provider (RoleProvider).
CustomEnables the user to specify a custom IPrincipal class for CurrentPrincipal.

When applying the PrincipalPermissionAttribute to a method, this mode specifies which set of roles to use when authorizing access. By default, the attribute uses Windows groups (such as Administrator or Users) to specify the role to which the user must belong.

To set the mode programmatically, create an instance of the ServiceHost class, then find the ServiceAuthorizationBehavior in its collection of behaviors, and set the PrincipalPermissionMode to the appropriate enumeration. The following example sets the property to UseAspNetRoles.

No code example is currently available or this language may not be supported.

You can also set the behavior in configuration by adding a <serviceAuthorization> element to the serviceBehaviors section of a configuration file, as shown in the following code.


<configuration>
 <system.serviceModel>
  <behaviors>
   <serviceBehaviors>
    <behavior name="myServiceBehavior">
      <serviceAuthorization principalPermissionMode="UseAspNetRoles" />
    </behavior>
   </serviceBehaviors>
  </behaviors>
 </system.serviceModel>
</configuration>


The enumeration affects how the PrincipalPermissionAttribute attribute authorizes a user when it is applied to a method. The following example applies the attribute to a method and demands that the user belong to the Users group on the computer. This code works only when the PrincipalPermissionMode is set to UseWindowsGroup (the default setting).

No code example is currently available or this language may not be supported.

UseAspNetRoles

The UseAspNetRoles value is used for all credential types. This mode enables to use the ASP.NET role provider to make authorization decisions.

When the credential for a service is an X.509 certificate, you can set the Name property of the PrincipalPermissionAttribute to a string that consists of the concatenated values of the Subject field and the Thumbprint field, as shown in the following example.


			Dim myServiceHost As New ServiceHost(GetType(Calculator), baseUri)
			Dim myServiceBehavior As ServiceAuthorizationBehavior = myServiceHost.Description.Behaviors.Find(Of ServiceAuthorizationBehavior)()
			myServiceBehavior.PrincipalPermissionMode = PrincipalPermissionMode.UseAspNetRoles
			Dim sm As New MyServiceAuthorizationManager()
			myServiceBehavior.ServiceAuthorizationManager = sm


No code example is currently available or this language may not be supported.

// Only a client authenticated with a valid certificate that has the 
// specified subject name and thumbprint can call this method.
[PrincipalPermission(SecurityAction.Demand,
     Name = "CN=ReplaceWithSubjectName; 123456712345677E8E230FDE624F841B1CE9D41E")]
public double Multiply(double a, double b)
{
    return a * b;
}


The concatenated string consists of the subject and thumbprint values separated by a semicolon and a space.

It is also possible for a certificate to have a Subject field set to a null string. In that case, you can set the Name property to a semicolon followed by a space and then the thumbprint, as shown in the following example.

No code example is currently available or this language may not be supported.

If an ASP.NET role provider is present, you can also set the Role property to a role in the database. By default, the database is represented by the SqlRoleProvider. You can also set a custom role provider with the RoleProvider property of the ServiceAuthorizationBehavior class. The following code sets the role to Administrators. Note that the role provider must map the user account to that role.

No code example is currently available or this language may not be supported.

For more information about the ASP.NET Role provider, see How To: Use Role Manager in ASP.NET 2.0.

For more information about using and the role provider, see How To: Use the ASP.NET Role Provider.

Custom

When the property is set to Custom, you must also provide a custom class that implements the IAuthorizationPolicy class. This class is responsible for providing the caller's IPrincipal representation inside the Properties collection. It must store the IPrincipal instance to the properties collection using the "Principal" string key, as shown in the following example.

evaluationContext.Properties["Principal"]=new CustomPrincipal(identity);

Background

The role-based security in .NET Framework enables applications to specify authorizations through code. By specifying the PrincipalPermission demand, the CurrentPrincipal must satisfy the PrincipalPermission requirement. For example, that the user must be in a specific role or group. Otherwise, the thread is not authorized to execute the code, which results in an exception. provides a set of PrincipalPermissionMode selections to specify the CurrentPrincipal based on SecurityContext accordingly.

The following example shows how to specify UseAspNetRoles.

No code example is currently available or this language may not be supported.

The following example shows how to specify Custom.

No code example is currently available or this language may not be supported.

.NET Framework

Supported in: 4, 3.5, 3.0

.NET Framework Client Profile

Supported in: 4, 3.5 SP1

Windows 7, Windows Vista SP1 or later, Windows XP SP3, Windows Server 2008 (Server Core not supported), Windows Server 2008 R2 (Server Core supported with SP1 or later), Windows Server 2003 SP2

The .NET Framework does not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.
Show: