'Allow users to view specific records based on custom security requirements
I need some advice on how best to implement a security mechanism in a ASP.net core application. The application users are authenticated using AD authentication. Is there a best practice for this type of implementation?
I have a list of project records. Users should only be able to retrieve a list of projects that they have permission to access. I have three user types that have different levels of access as detailed below.
- Approvers – assigned to individual projects.
- State approvers – Can view state-wide projects.
- Global approvers – Can access all projects.
Does anyone have any suggestions on what model and logic to implement to achieve what is required?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|