I have a particularly thorny security problem in which I am debating extending the membership API vs. creating my own custom authorization "framework". I have an ASP.NET 3.5 web application with contain several pages, one of which hosts a Flex application we are developing. This Flex application communicates with web services we have developed contained within the same ASP.NET 3.5 web application. We are securing the web application (and services) using Forms Authentication which works well for authentication. However, our security model is quite flexible and I do not think the current membership API is up to the task of handling this model.
Our security model contains users, roles, and permissions (actions). Users are self explanatory. Roles can be created and deleted through the application by appropriately privileged users, however roles do not directly determine what restrictions a user has. This is accomplished via a finite list of permissions. ...
Go to the complete details ...