Improving Web Application Security: Threats and - CGISecurity

Chapter 17: Securing Your Application Server 495COM+ Role-Based SecurityAuthorization in Enterprise Services applications is provided by Enterprise Services(COM+) roles. COM+ roles contain Windows user and group accounts and are usedto restrict access to the application, component, interfaces, and method. Ideally, yourEnterprise Services applications should be configured for component levelauthorization, which allows you to authorize callers to individual servicedcomponent methods.To configure role-based security:● Enable role-based security.●●Enable component-level access checks.Enforce component-level access checks.Enable Role-Based SecurityRole-based security is disabled by default on Windows 2000. The reverse is true forWindows Server 2003. To enable role-based security1. Start the Component Services tool and display the Properties dialog box of theapplication.2. Click the Security tab.3. Select Enforce access checks for this application.Figure 17.7Enabling role-based securityEnable Component-Level Access ChecksWithout component-level access checks, any account that is used to connect to anyapplication component is granted access if it is a member of any role within theapplication. Component-level access checks allow individual components to applytheir own authorization. This is the recommended level of granularity.