title: NetSqlAzMan vs AzMan vs (?????)
body: <p>I've been trying to "read between the lines" about the original (and/or current) motivation for the NetSqlAzMan project.</p>
  
  <p>Was this written for?</p>
  
  <ol>
  <li><p>An adapter for Windows Authorization Manager (AzMan).  Where the methods in the NetSqlAzMan just passes calls to (Windows Authorization Manager (AzMan)), but perhaps with nicer/cleaner methods?</p></li>
  <li><p>A replacement for (Windows Authorization Manager (AzMan)).  Where (most or all of) the features available in (Windows Authorization Manager (AzMan)) are recreated in NetSqlAzMan, but the code was developed independently.
  (Perhaps to provide DotNet 4.0 support???) (Perhaps to remove any COM dependencies)</p></li>
  <li><p>To provide more features than (Windows Authorization Manager (AzMan)) provided.  Aka, a "smarter"/"better" version of (Windows Authorization Manager (AzMan)).</p></li>
  <li><p>To rewrite but also keep a semi-dead project alive through open-source.  (As in, perhaps (Windows Authorization Manager (AzMan))) is a dead or abandoned project by Microsoft).  </p></li>
  <li><p>Other?</p></li>
  </ol>
  
  <p>................</p>
  
  <p>I like the object model of NetSqlAzMan.  But I need to defend any decision to use it to my project manager(s) and other developers.
  The object model seems "just right" (think <a href="http://www.pmcgee.net/prodesign/goldilocks_large.jpg" rel="noreferrer">goldilocks</a> and the middle bed) as far as what I desire for security.
  I do NOT want to do role based security.  I want right(or task or permission) based security.</p>
  
  <p>(See:
  <a href="http://lostechies.com/derickbailey/2011/05/24/dont-do-role-based-authorization-checks-do-activity-based-checks/" rel="noreferrer">http://lostechies.com/derickbailey/2011/05/24/dont-do-role-based-authorization-checks-do-activity-based-checks/</a>
  and 
  <a href="http://granadacoder.wordpress.com/2010/12/01/rant-hard-coded-security-roles/" rel="noreferrer">http://granadacoder.wordpress.com/2010/12/01/rant-hard-coded-security-roles/</a>
  )</p>
  
  <p>And basically the question that came up is:  "What is the advantage of using NetSqlAzMan instead of (Windows Authorization Manager (AzMan))?"</p>
  
  <p>And the sub question is "Is Windows Authorization Manager (AzMan) dead?".  (And something along the lines of Long Live NetSqlAzMan!).</p>
  
  <p>..................</p>
  
  <p>My in-general requirements are:</p>
  
  <p>Non Active-Directory users.  (Down the road Active Directory and/or LDAP support would be nice, but not a requirement).
  Passwords not stored as plain text.
  Be able to handle RIGHTS for security checks.<br>
  Group the rights under any role.
  Assign roles to users.  (But again, the code will check for the right, not the role when performing an action.)
  Allow (on occasion) rights to be assigned to users.  With a Deny override.  (Aka, a single user who does on stupid thing (like "Delete Employee") can have that right revoked.)
  Roles and Rights can be maintained for multiple applications.</p>
  
  <p>So other ideas are welcome.  But <a href="http://blogs.msdn.com/b/card/archive/2009/10/20/how-geneva-helps-with-access-control-and-what-is-its-relationship-to-azman.aspx" rel="noreferrer">Windows Identity Foundation</a> seems like a little overkill.</p>
  
  <p>Thanks.</p>