Authorization is a security mechanism used to determine user/client privileges or access levels related to system resources, including computer programs, files, services, data and application features. Authorization is normally preceded by authentication for user identity verification. System administrators (SA) are typically assigned permission levels covering all system and user resources.
During authorization, a system verifies an authenticated user’s access rules and either grants or refuses resource access.
Modern and multiuser operating systems depend on effectively designed authorization processes to facilitate application deployment and management. Key factors include user type, number, credentials requiring verification and related actions and roles. For example, role-based authorization may be designated by user groups requiring specific user resource tracking privileges. Additionally, authorization may be based on an enterprise authentication mechanism, like Active Directory (AD), for seamless security policy integration.
For example, ASP.NET works with Internet Information Server (IIS) and Microsoft Windows to provide authentication and authorization services for Web-based .NET applications. Windows uses New Technology File System (NTFS) to maintain Access Control Lists (ACL) for all resources. The ACL serves as the ultimate authority on resource access.
The .NET Framework provides an alternate role-based security approach for authorization support. Role-based security is a flexible method that suits server applications and is similar to code access security checks, where authorized application users are determined according to roles.
