RIA 服务允许您向域服务方法添加属性，例如：RequiresRole("Admin")。这将自动检查调用该方法的用户是否具有正确的安全性。我想对实体的财产做类似的事情。例如，仅允许角色“经理”的用户更改“速率”属性，但任何用户都可以更改“评论”属性。这可能吗？
RIA services allows you to add an attribute to a domain service method like: RequiresRole("Admin"). This will automatically check if the user calling that method has the correct security to do so. I would like to do something similar for a property on an entity. For example, only users in the role "Manager" are allowed to change the "Rate" property, but any user can change the "Comments" property. Is this possible?
发布评论
评论（2）
支持属性安全性的更好方法是重写 DomainService.Query 方法，这样您就可以避免加载大量过多的数据。在此处发表了更多有关它的博客。
A better way to support security for properties is by overriding DomainService.Query method, this way you'll avoid loading lots of excessive data. Blogged more about it here.
您可以使用 来执行此操作自定义验证属性。您可以创建一个属性（例如 RequiresManagerRole），该属性将检查用户是否属于管理员角色，如果用户不属于管理员角色，则不允许进行更改。
然而，这对于用户来说可能不是很好的体验。您可能希望以某种方式绑定表单中的只读属性，以确定该属性是否可编辑。您可以使用 IValueConverter 来做到这一点，并在值转换器中检查用户的角色以确定它是否是只读的。
更新：好的，我认为 Brad 看到了这个问题并且 写这篇博文来解决这个问题。这应该解决您想要做的事情，但采取不同的方法。
You could do this using a Custom Validation attribute. You could create an attribute such as RequiresManagerRole that would check to see if the user is in the Manager role and would not allow the change if the user wasn't.
That might not be a very good experience for the user however. You'd probably want to somehow bind the readonly property in the form to figure out if the property was editable. You might be able to do that with an IValueConverter and in your value converter check the role of the user to determine if it is read only.
Update: Ok I think Brad saw this question and wrote this blog post to address it. This should address what you want to do but takes a different approach to it.