Member Avatar for mansoorhacker

hello dear developers.

i have recently completed a c# application.

i have also created user accounts and there respected logins.

after saying that now i want to build a system in which specific users have specific rights on reports,edit action on accounts and other sql related rights.

how could i do this, if u have any idea plz help me.

thx in advance.

bye

  • 2 Contributors
  • 1 Reply
  • 294 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by kvprajapati

Dani AI

Generated

A practical, maintainable pattern for this problem is Role-Based Access Control (RBAC) layered on top of the existing authentication. 's links are a good background pointer; below is a concrete design and implementation checklist for a C# + SQL Server app that fills the gaps between “accounts and logins” and fine-grained rights like report viewing or edit actions.

Start with a simple, explicit schema that models Roles, Permissions and their mappings (optional per-user overrides). Permission keys should be descriptive strings (for example Report.View.Sales or Account.Edit) so checks stay readable.

CREATE TABLE Roles (
  RoleId INT IDENTITY PRIMARY KEY,
  RoleName NVARCHAR(100) NOT NULL
);

CREATE TABLE Permissions (
  PermissionId INT IDENTITY PRIMARY KEY,
  PermissionKey NVARCHAR(200) NOT NULL
);

CREATE TABLE RolePermissions (
  RoleId INT NOT NULL,
  PermissionId INT NOT NULL,
  PRIMARY KEY (RoleId, PermissionId)
);

CREATE TABLE UserRoles (
  UserId INT NOT NULL,
  RoleId INT NOT NULL,
  PRIMARY KEY (UserId, RoleId)
);

CREATE TABLE UserPermissions (
  UserId INT NOT NULL,
  PermissionId INT NOT NULL,
  IsAllowed BIT NOT NULL DEFAULT 1,
  PRIMARY KEY (UserId, PermissionId)
);

At login, aggregate the effective permission set for the user and keep it in memory (or as claims). Expose a compact HasPermission(string) method on a custom principal and always enforce that check in the business/data layer (UI-only hiding is only UX). Example pattern in C#:

public class AppPrincipal : IPrincipal
{
    public IIdentity Identity { get; }
    HashSet<string> _perms;
    public AppPrincipal(IIdentity id, IEnumerable<string> perms) { Identity = id; _perms = new HashSet<string>(perms); }
    public bool IsInRole(string role) => false;
    public bool HasPermission(string key) => _perms.Contains(key);
}

Operational notes and best practices: do not grant application users direct SQL logins—use a single least-privileged DB account and prefer stored procedures for mutations. Always parameterize queries to avoid injection. Provide an admin UI for role/permission management and ensure caches are invalidated when role assignments change. For troubleshooting, confirm the join query that produces permissions, check cache refresh after role edits, and log denied attempts so missing rules surface quickly.

This approach keeps authorization explicit, auditable, and easy to extend as reports or actions grow.

Member Avatar for kvprajapati

>i have recently completed a c# application.

I hope, you can be able to develop more applications very soon.

>after saying that now i want to build a system in which specific users have specific rights on reports,edit action on accounts and other sql related rights.

Albeit this links:

1. http://msdn.microsoft.com/en-us/library/90k49ccb.aspx
2. http://msdn.microsoft.com/en-us/library/aa983766%28VS.71%29.aspx
3. http://stackoverflow.com/questions/784608/how-to-implement-security-component-in-windows-forms

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.