Authorization

There are two types of authorization that you can use in your assemblies to control access to classes and class members :

• Role-based authorization to authorize access based on user identity and rolemembership . When you use role-based authorization in assemblies that are part of an ASP.NET Web application or Web service, you authorize the identity that is represented by an IPrincipal object attached to the current Web request and available through Thread.CurrentPrincipal and HttpContext.Current.User . This identity is either the authenticated end user identity or the anonymous Internet user identity. For more information about using principal-based authorization in Web applications, see "Authorization" in Chapter 10, "Building Secure ASP.NET Pages and Controls."

• Code access security to authorize calling code, based on evidence, such as an assembly's strong name or location . For more information, see the "Authorization" section in Chapter 8, "Code Access Security in Practice."