What Is the Security Application Block?

The primary design goals for the Security Application Block were to make an application more flexible by allowing it to abstract itself away from needing to know where this information is maintained. Each type of data is accompanied by a respective provider that handles the most common tasks associated with that data. For example, AuthenticationProviders exist that let you write an application that determines whether a user can be authenticated without the need for you to know where the authentication information is stored or how the determination of authentication is performed. At the same time as providing this flexibility, the Security Application Block is designed to be as simple as possiblethe only method that you need to learn to authenticate a user is Authenticate.

By subscribing to the Provider pattern, yet another benefit is realized. An application is not tied to any specific user store for accessing the necessary information. If user information is moved from one store to another, you don't need to change any application code; you just have to modify the configuration for that application.

Relationship to the Authorization and Profile Application Block

Microsoft released a subset of the features of the Security Application Block as the Authorization and Profile Application Block in January 2004. There are some important differences to keep in mind if you need to migrate from the previous application block to Enterprise Library's Security Application Block.

• The previous block only focused on two of the five features that exist in the current Enterprise Library block: authorization and profile management. Authentication, Authorization, Roles, Profiles, and Security Caches all have separate provider interfaces in the current incarnation.

• There is no need to use an extended principal with additional methods in the Security Application Block.

• Cryptography functionality has been migrated to the Cryptography Application Block (covered in Chapter 8).

• Some of the features of the AuthorizationManagerProvider (AzManProvider) don't exist in the current providers. Features like the CheckAccess method that supports passing dynamic business rule parameters and values as well the Getroles method for acquiring a collection of roles for a given identity are no longer included. The latter isn't too big a deal thoughI'll show how to add your own RolesProvider to Getroles from AzMan.