IN THIS CHAPTER, you'll investigate how to use Role Access Security (RAS) to protect resources. You'll study the definitions that are found in .NET and how they work. Finally, you'll learn about impersonation and how it works in .NET.

Let's start by looking at the .NET types that are used in RAS from a coding perspective.

Using .NET Class Definitions

All of the .NET class definitions types are in the System.Security.Principal namespace, and all can be found in the mscorlib assembly. Some classes define what identities and principals there are along with their relationship to each other. Other classes exist that help in defining how identities and principals are established for the current thread of execution. In this section, I'll cover the basics of these classes.

Let's start by looking at the definition of an identity in .NET.

IIdentity Interface

The IIdentity interface is used to define information about a user. Typically, that user is running the current code, although there's no requirement that a class that implements this interface has to relate to the underlying OS user. IIdentity defines three read-only properties:

• Name: A string that defines the logical name of the user. This can take on any form-a typical format is "domain\user" (for example, "apress\jbock").
• AuthenticationType: A string that defines the kind of authentication used to verify the user. Examples of common authentication schemes are Kerebos and Passport.
• IsAuthenticated: A Boolean that states whether the current user has been authenticated.

.NET supplies the four following implementations of IIdentity:

• GenericIdentity
• WindowsIdentity
• FormsIdentity
• PassportIdentity