How to implement row level security in ASP.NET boilerplate?

Question

I started using ASP.NET Boilerplate a month back, so this is a beginner-level question. I feel it's a great framework — thanks a lot for creating and sharing this.

I was developing a multi-tenant application and now I want to filter rows based on tenant. What is the correct way of doing it in ASP.NET Boilerplate? I was thinking of passing TenantId with every DB call or creating a request context, which would have all details, and passing that along to the method call. And then, in the method, check if that particular row's TenantId matches with what we are passing. If not then discard, else proceed. With a few tweaks here and there, I may achieve what I want, but I want to know what is the correct way of doing it in ASP.NET Boilerplate.

Second, any out-of-the-box example of integrating Row Level Security feature of SQL Server in ASP.NET Boilerplate?

Thanks a lot.

Welcome. Could you just paste the code along with the description? — Bruno Berisso
– Bruno Berisso, Commented Nov 23, 2018 at 18:33

aaron · Accepted Answer · 2018-11-23 23:51:51Z

2

I was developing a multi-tenant application and now I want to filter rows based on tenant. What is the correct way of doing it in ASP.NET Boilerplate? I was thinking of passing TenantId with every DB call or creating a request context, which would have all details, and passing that along to the method call. And then, in the method, check if that particular row's TenantId matches with what we are passing. If not then discard, else proceed.

That's a built-in feature of ASP.NET Boilerplate, implemented via EF Core's Global Query Filters.

More info: https://aspnetboilerplate.com/Pages/Documents/Multi-Tenancy#data-filters

Second, any out-of-the-box example of integrating Row Level Security feature of SQL Server in ASP.NET Boilerplate?

No, all DB calls are made by the same trusted DB user determined by the connection string.

You might have misunderstood Row-Level Security.

You could pass a different connection string based on the application user, but that's simply application-level authorization — also built-in, implemented via Castle Windsor's Interceptors.

More info: https://aspnetboilerplate.com/Pages/Documents/Authorization

answered Nov 23, 2018 at 23:51

aaron

43.4k6 gold badges55 silver badges113 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Zainu Over a year ago

aspnetboilerplate.com/Pages/Documents/… ideally explains the filter with TenantId and with IPermissionChecker (aspnetboilerplate.com/Pages/Documents/Authorization ) I can achieve what I want.Thanks a lot for sharing these details.

Collectives™ on Stack Overflow

How to implement row level security in ASP.NET boilerplate?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related