CODEWITHSUNDEEP
asp.netsql-servermulti-tenantaspnetboilerplaterow-level-security
Zainu
Zainu

Reputation: 120

How to implement row level security in ASP.NET boilerplate?

I started using ASP.NET Boilerplate a month back, so this is a beginner-level question. I feel it's a great framework — thanks a lot for creating and sharing this.

I was developing a multi-tenant application and now I want to filter rows based on tenant. What is the correct way of doing it in ASP.NET Boilerplate? I was thinking of passing TenantId with every DB call or creating a request context, which would have all details, and passing that along to the method call. And then, in the method, check if that particular row's TenantId matches with what we are passing. If not then discard, else proceed. With a few tweaks here and there, I may achieve what I want, but I want to know what is the correct way of doing it in ASP.NET Boilerplate.

Second, any out-of-the-box example of integrating Row Level Security feature of SQL Server in ASP.NET Boilerplate?

Thanks a lot.

Upvotes: 1

Views: 2328

Answers (1)

aaron
aaron

Reputation: 43083

I was developing a multi-tenant application and now I want to filter rows based on tenant. What is the correct way of doing it in ASP.NET Boilerplate? I was thinking of passing TenantId with every DB call or creating a request context, which would have all details, and passing that along to the method call. And then, in the method, check if that particular row's TenantId matches with what we are passing. If not then discard, else proceed.

That's a built-in feature of ASP.NET Boilerplate, implemented via EF Core's Global Query Filters.

More info: https://aspnetboilerplate.com/Pages/Documents/Multi-Tenancy#data-filters

Second, any out-of-the-box example of integrating Row Level Security feature of SQL Server in ASP.NET Boilerplate?

No, all DB calls are made by the same trusted DB user determined by the connection string.

You might have misunderstood Row-Level Security.

You could pass a different connection string based on the application user, but that's simply application-level authorization — also built-in, implemented via Castle Windsor's Interceptors.

More info: https://aspnetboilerplate.com/Pages/Documents/Authorization

Upvotes: 2

Related Questions