I have a .Net application which has authentication and fine grained feature access control managed via a proprietary database (i.e. a flat file). By "fine grained" I mean, for example, access control permissions enable some users to click on a specific button in the UI while other users only ever see a that button as a disabled button.

Ideally I'd like to get rid of my proprietary database and and the utility code which allows a user to edit the database. As we're in a Windows environment I was immediately drawn towards Active Directory because it seems so much of my work life is controlled by IT and their Active Directory settings.

My first problem is I know nothing about Active Directory. I've quickly become overrun with new terms such as Group Policy, Application Access Control Policy & Access Control List. I'm having such a hard time finding guidelines/tutorials etc on doing what I'm trying to do I'm starting to think I've made a mistake and the purpose of Active Directory is for authentication and for Windows access control, not for access control of home grown .Net applications.

My current thought is to attempt to make each fine grained permission an Active Directory Object (ADO), define roles for using my app as Active Directory Groups (ADG) and through Access Control Lists associate an ADG or some ADG's with each ADO.

At the moment I think my only answerable question is what type of ADO should I use?

They'll help you over here.

https://social.msdn.microsoft.com/Forums/en-US/home?forum=windowssecurity%2Cwindowsgeneraldevelopmentissues%2Cvbgeneral%2CGeneva%2Cnetfxbcl%2Ccsharpgeneral%2Cadodotnetdataproviders%2Cwinforms&filter=alltypes&sort=lastpostdesc

 

 

 

Thanks that looks like a great list of development forums. I don't believe that's what i'm after am I? I thought I needed to know how Active Direct Objects should be structured to give me the model against which I will code.

This one may help you get started. I think you'll want to ask in MSDN forums on how to apply that to your coding situation.

https://msdn.microsoft.com/en-us/library/system.directoryservices.activedirectory(v=vs.110).aspx