Question

I'm using something like this on my server:

TcpServerChannel channel = new TcpServerChannel(settings.RemotingPort);
ChannelServices.RegisterChannel(channel, true);
RemotingServices.Marshal(myRemoteObject, "myRemoteObject");

I would like to subscribe to some kind of event so that whenever a remote client connects to myRemoteObject, I can check the Thread.CurrentPrincipal.Identity.Name to decide whether to authorize him.

Currently I'm doing the authorizing check in every exposed remote method of myRemoteObject which is a messy...

Was it helpful?

Solution

In my remoting application i defined a special object/interface where clients first need to authorize. The special object then returns, if the client successfully authorized the remote object. So you have the authorization at one place.

It looks something like this.

public interface IPortal
{
  object SignIn(string name, string password);
}

public class Portal : MarshalByRefObject, IPortal
{
  private object _remoteObject;

  public Portal() {
    _remoteObject = new RemoteObject();
  }

  public object SignIn(string name, string password) 
  {
    // Authorization
    // return your remote object

    return _remoteObject;
  }
}

In your application you host the Portal-Object

TcpServerChannel channel = new TcpServerChannel(settings.RemotingPort);
ChannelServices.RegisterChannel(channel, true);
Portal portal = new Portal()
RemotingServices.Marshal(portal , "portal");

OTHER TIPS

You could use something like PostSharp to factor out the check from every method - just do it in the AOP advice. (You apply this to the class which is exposing its methods, not to the client connection.)

This approach is independent of whatever transport you use for remoting - it just factors out the cross-cutting concern of authorization across all the methods in your remoted class.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top