> // Can't be implemented on read-only providers
> void AddUsersToRoles(string[] usernames, string[] roleNames);
> void CreateRole(string roleName);
> bool DeleteRole(string roleName, bool throwOnPopulatedRole);
> void RemoveUsersFromRoles(string[] usernames, string[] roleNames);
I'm fairly certain that it's acceptable that some methods can throw
NotImplementedException in support of a read-only provider.
> // Can't be implemented without a list of the entire set of Roles
> string[] GetAllRoles();
> bool RoleExists(string roleName);
One option here is to implement these with static data. In the
authorization use case, it's pretty reasonable to expect that the
application should know the complete set of roles it will be dealing
with. I'll admit the out-of-band coupling of data between the backing
authorization store and the CASified application could be problematic
in cases where role data is dynamic.
> // Can't be implemented without a mapping of all {user, role}'s
> string[] FindUsersInRole(string roleName, string usernameToMatch);
> string[] GetRolesForUser(string username);
> string[] GetUsersInRole(string roleName);
> bool IsUserInRole(string username, string roleName);
I'm fairly certain we can accommodate authorization use cases without
a global (user,role) mapping. I believe that it should be sufficient
to answer questions about the current principal whose data would be
fully available in the assertion.
M
--
You are currently subscribed to [email protected] as:
[email protected]
To unsubscribe, change settings or access archives, see
http://www.ja-sig.org/wiki/display/JSG/cas-dev
