Field level security performance with Rhino Security

Last year I wrote a post on how to add field level security in your ASP.NET MVC application. When testing the solution it turned out that the performance was unacceptable. The reason for this is that we need to check the permissions for every control on a create or edit page. For some of our entities we have rather big edit pages with more than 20 controls. So we needed to come up with another solution. I sat together with a colleague and together we came up with the following.

Since most of the time an edit or a create page contains properties of a single entity and maybe some related entities we thought it would be better to get the permissions of all fields of an entity in one go and store them somewhere for the lifetime of a request.

That's why we now have a "SecurityService" that keeps a dictionary of "AccessRights" like this:

   1: public class SecurityService : ISecurityService

   2:     {

   3:         private readonly Dictionary<Type, ICollection<Permission>> accesrights =

   4:             new Dictionary<Type, ICollection<Permission>>();

When getting the rights we first check whether we do not already have them and otherwise we go and get them:

   1: private ICollection<Permission> GetFieldLevelPermissionsFor(Type t)

   2: {

   3:     User user = userService.GetUser(HttpContext.Current.User.Identity.Name);

   4:     DetachedCriteria criteria = DetachedCriteria.For<Permission>();

   5:     criteria.Add(Restrictions.Eq("UsersGroup", user.UserGroup));

   6:     DetachedCriteria subcriteria = criteria.CreateCriteria("Operation", "Operation", JoinType.InnerJoin);

   7:     subcriteria.Add(Restrictions.Eq("OperationType", OperationType.Field));

   8:     subcriteria.Add(Restrictions.Like("Name", string.Format("/{0}/", t.Name), MatchMode.Start));

   9:     return Repository<Permission>.FindAll(criteria);

  10: }

  11:  

  12: public ICollection<Permission> GetRightsForType<T>()

  13: {

  14:     return GetRightsForType(typeof (T));

  15: }

  16:  

  17: public ICollection<Permission> GetRightsForType(Type t)

  18: {

  19:     ICollection<Permission> rights = null;

  20:  

  21:     if (accesrights.Keys.Contains(t))

  22:     {

  23:         rights = accesrights[t];

  24:     }

  25:     else

  26:     {

  27:         //rechten ophalen en in dictionary steken

  28:         rights = GetFieldLevelPermissionsFor(t);

  29:         accesrights[t] = rights;

  30:     }

  31:  

  32:     return rights;

  33: }

The secured textbox extension method has been changed. It now uses the "SecurityService".

   1: public static string SecuredTextBox<T>(this HtmlHelper htmlHelper, string name, string labelText, 

   2:             Expression<Func<T,object>> property, object instance, IDictionary<string, object> htmlAttributes, string additionalHtml)

   3:         {

   4:             var securityService = SystemFactory.BuildUp<ISecurityService>();

   5:             var level = securityService.GetAccessLevel(property);

   6:  

   7:             if (level == AccessLevel.None)

   8:             {

   9:                 return String.Empty;

  10:             }

  11:  

  12:             htmlAttributes = htmlAttributes ?? new Dictionary<string, object>();

  13:             htmlAttributes.Add("id", name);

  14:  

  15:             // set the value if an instance was passed

  16:             if (instance != null)

  17:             {

  18:                 var compiled = property.Compile();

  19:                 var value = compiled((T)instance);

  20:  

  21:                 if (value != null)

  22:                     htmlAttributes.Add("value", value);

  23:             }

  24:  

  25:             // readonly? -> add readonly attribute

  26:             if (level == AccessLevel.Read)

  27:                 htmlAttributes.Add("readonly", "readonly");

  28:  

  29:             string dateformat = string.Empty;

  30:             string addHtml = additionalHtml;

  31:             if (htmlAttributes.Contains(new KeyValuePair<string, object>("class", "date")))

  32:             {

  33:                 dateformat = additionalHtml;

  34:                 addHtml = string.Empty;

  35:             }

  36:             return string.Format("<div style=\"padding: 0.5em\"><label for=\"{0}\">{1}:{2}  {3}</label><div>{4} {5}</div></div>", name, htmlHelper.Encode(labelText),

  37:                                     (htmlAttributes.ContainsKey("mandatory") ? "<span class='reqMark'>*</span>" : string.Empty),

  38:                                     dateformat,

  39:                                     htmlHelper.TextBox(name, htmlAttributes), addHtml);

  40:         }        

It is however a local variable, so you must be wondering how it is possible that the securityservice still keeps state between calls to SecuredTextBox within the same request. There we have Windsor to help us. There is a "PerWebRequest" lifestyle that you can use so that your components are only created once per http request. So we just configured our "SecurityService" in Binsor as follows and we're done.

   1: Component("Security_Service",

   2:            ISecurityService,

   3:            SecurityService,LifestyleType.PerWebRequest)