Overview

In Windows Server 2003, Microsoft is exploring some interesting new paths in the area of access control enforcement. One of them is support for role-based access control management, using a technology called the Authorization Manager and a brand-new API the Authorization API.

A path that is at least as interesting as the previous one is the support for digital rights management (DRM). Microsoft calls their enterprise DRM solution Rights Management Services (RMS).

This chapter provides an introduction to both the Authorization Manager and Rights Management Services.

12.1 Role-based access control

Authorization Manager is a fundamental shift In Microsoft s way of dealing with access control enforcement and management. In the long run it will affect everyone (including architects, administrators, and developers) who is dealing with the new generation of Microsoft enterprise operating systems and the applications that are running on top of these platforms. The Authorization Manager is all about Microsoft s efforts to introduce a role- based access control model (RBAC) for applications running on top of the Windows platform.

In Windows Server 2003 Authorization Manager and its role-based access control model can be used to role-enable LOB applications. An interesting combination is using Authorization Manager together with IIS 6.0 s URL- based authorization feature. So far, MS does not provide applications that are out-of-the-box role-enabled and in that sense at the time of writing Authorization Manager is mainly developer-focused. In the years to come MS may however natively RBAC-enable other Windows applications.