COM+ Programming with Visual Basic

Summary

The first half of this chapter reviews the terminology that relates to security. All applications run under a certain set of credentials, and this set of credentials is known as the process token. You can use this token to extract information—such as the account name and the groups the account belongs to—about the account used to start the process. By default, threads in a process do not have their own tokens. A thread may decide to use an alternate token; this is called impersonation. The thread will then do some work, and the system will reject or grant access to resources based on the new set of credentials.

COM+ security is built on top of RPC security. In RPC security as well as in COM+ security, the client is the one that dictates the security settings, and the server grants or rejects calls programmatically. COM+ simplifies the process of rejecting and granting access to functions in several ways. For one thing, COM+ enables you to set the minimum level of authentication through declarative properties. Then you can further restrict access into your application by creating roles. By default, security is turned off for your application. If you turn it on, you can tell COM+ if you wish to check security only at the application level or at the application level and the component level. If a user is assigned to a role, even if the role is not assigned to a component, interface, or method, the user will be able to launch the application and create instances of the components. ...