This was going to be a single post, but it got too long - so this first part introduces Authorization Manager and describes how to get it setup, and the second part will discuss how to apply this technology in the ArcGIS environment.

Authorization Manager
Also known as AzMan, this is a component of Windows Server 2003 which provides a "role-based" security store along with a developer API that you can work against. At it's core, AzMan works with "Operations" to which access is granted or revoked based on role membership. In addition to working directly with roles and groups on the local machine or in Active Directory, AzMan can also manage it's own roles and groups. This is very convenient if IT policy does not allow you to have application specific roles & groups in Active Directory itself. Although the AzMan API (azroles.dll) is installed on XP by default, you need to download the Windows Server 2003 admin kit to get the managment console snap-in. If you are running in Vista or Windows Server 2003, this is already installed.

How it works (30,000 foot view)

The application uses AzMan to ask if a user has access to a particular Operation. AzMan looks at the users group & role membership and determines if they have access. Simple & clean.

This is very nice in that it provides a layer of indirection between your application code and the authorization system. As long as the authorization system knows about the operations you application is going to request, it does not matter how the users are granted access (via Active Directory roles & groups, via AzMan roles & groups, or via individual users). This is much preferable to writing an application which depends on specific roles & groups to exist in Active Directory.

Using AzMan

Before we start building an application, we need to setup an AzMan repository that we can use to control access to our functions. For this example we are using an Xml file to store the repository but it's also worth noting that you can store it in Active Directory. Again, I highly recommend Keith Brown's screen casts for the details. At a high-level, these are the steps:

1) Open the AzMan MMC (Start --> Run --> azman.msc

2) Change to developer mode
3) Create a new repository (xml file)
4) Create an Application ("ExampleApp") and add operations
6) Create roles (Managers) & assign operations to the roles
7) Grant users (local or Active Directory) access to the operation