I am implementing security into a C# asp.net 2.0 application. When a user is logged via windows authentication and all the groups that user is associated with in active directory is pulled. Each group has permission associated with it.
For example, "XX-VMSuperviser" group has delete, edit, read, add, etc.. permissions and XX-VMOperator" group has read and edit permission.
What would be the best approach to storing and retieving these permissions?
One way I considered:
1) put permission in a xml file (instead of DB or web.config):
<group>
<superviser>
<permission>Edit 001</permission>
<permission>Delete 001</permission>
<permission Go to the complete details ...