Deploy ADO.NET Data Service

Question

What is the best way to protect ADO.NET data? Has anyone used this in production, if so, what security settings did you use?

Answer 1

The following is an entry that details how to secure the ADO.NET Data Service.

Answer 2

@tbreffni publishes a good blog post. In addition to setting up access rules for entities in your ado.net data service to control how access is granted for different objects in the underlying entity data model.

Assuming you have code like this:

public class Northwind : DataService<NorthwindEntities> { public static void InitializeService(IDataServiceConfiguration config) { config.SetEntitySetAccessRule("*", EntitySetRights.All); } } 

The SetEntitySetAccessRule method allows you to reference either the entire entity model or only a specific set of objects, and then determine the permissions based on the EntitySetRights enumeration. The following values ​​are listed:

No Cancels all data access rights.

ReadSingle Authorization to read individual data items.

ReadMultiple Authorization for reading datasets.

WriteAppend Authorization to create new data items in datasets.

WriteReplace Authorization to replace data.

WriteDelete Authorization to delete data items from data sets.

WriteMerge Authorization for combining data.

AllRead Authorization to read data.

AllWrite Authorization to write data.

All Authorization to create, read, update and delete data.

A step-by-step guide to using Microsoft ADO.NET services goes through this process here . The EntitySetRights enumeration is documented here .

Answer 3

Do you mean secure individual types of requests or the entire service ?. If the whole service, then you can use standard IIS methods for security, such as Windows authentication. In a controlled Windows environment where a web service consumes services, you can configure the identifier of one domain, which will be an authorized user between the mailboxes. Of course, use SSL to provide secure data encryption.