COM & .NET Component Services

Securing a Server Application

Controlling access to your components via role-based security is all fine and well, but there is more to security than just access control. You must still set the security identity for your application and set the authentication and impersonation levels. Configuring security for a server application is different from that of a library application, justifying each application type in a separate section.

When designing and configuring a server application security, you need to do the following:

• Decide on the security identity under which the server application executes.

• Decide what authorization (access control) the server application requires—how granular access control should be.

• Decide at what authentication level to authenticate incoming calls.

• Decide at what impersonation level you grant objects in other applications when this server application is the client of those objects.

• Configure your server application security.

The following sections discuss these action items in depth.

Configuring the Server Application Identity

When you invoke the Application Install Wizard and use it to create a new server application, the Wizard presents you with a dialog box that lets you set the security identity of the server application. Setting the security identity determines what user account all components in that application will run under, which dictates credentials, privileges, and access rights (see Figure 7-8). You may either run the application as the