Authorizing operations in PowerShell

Hi all, i'm investigating the possibility of authorizing certain operations for certain users in a dynamic fashion
After reading the article "Developing Applications Using Windows Authorization Manager" @ http://msdn2.microsoft.com/en-us/library/aa480244.aspx i've determined that Authorization Manager will suit m needs for defining access permissions,
however i'm unsure where to plug the authorization validation into powershell. PowerShell SDK mentions System.Management.Automation.AuthorizationManager @ http://msdn2.microsoft.com/en-us/lib...onmanager.aspx which controls is Commands Should run and supply a Reason for not running command.
The PowerShell SDK topic "How to Create a Console Shell" http://msdn2.microsoft.com/en-us/library/aa965352.aspx shows how to use the -authorizationmanager parameter of make-shell to specify a cutom authorization manager.

Am i correct in assuming i have to create a custom shell and deny access to the standard powershell to plug my custom AuthorizationManager into powershell, and that this can/should only be done by creating a custom shell.

regards
Joris van Lier

Joris van Lier wrote:
> Hi all, i'm investigating the possibility of authorizing certain
> operations for certain users in a dynamic fashion
> After reading the article "Developing Applications Using Windows
> Authorization Manager" @
> http://msdn2.microsoft.com/en-us/library/aa480244.aspx i've
> determined that Authorization Manager will suit m needs for defining
> access permissions,
> however i'm unsure where to plug the authorization validation into
> powershell. PowerShell SDK mentions
> System.Management.Automation.AuthorizationManager @
> http://msdn2.microsoft.com/en-us/lib...onmanager.aspx
> which controls is Commands Should run and supply a Reason for not
> running command.
> The PowerShell SDK topic "How to Create a Console Shell"
> http://msdn2.microsoft.com/en-us/library/aa965352.aspx shows how to
> use the -authorizationmanager parameter of make-shell to specify a
> cutom authorization manager.
>
> Am i correct in assuming i have to create a custom shell and deny
> access to the standard powershell to plug my custom
> AuthorizationManager into powershell, and that this can/should only
> be done by creating a custom shell.
>
> regards
> Joris van Lier

forgot to ask:
Can I define the AuthorizationManager to use when using RunspaceInvoke?

Joris van Lier wrote:
> Joris van Lier wrote:
>> Hi all, i'm investigating the possibility of authorizing certain
>> operations for certain users in a dynamic fashion
>> After reading the article "Developing Applications Using Windows
>> Authorization Manager" @
>> http://msdn2.microsoft.com/en-us/library/aa480244.aspx i've
>> determined that Authorization Manager will suit m needs for defining
>> access permissions,
>> however i'm unsure where to plug the authorization validation into
>> powershell. PowerShell SDK mentions
>> System.Management.Automation.AuthorizationManager @
>> http://msdn2.microsoft.com/en-us/lib...onmanager.aspx
>> which controls is Commands Should run and supply a Reason for not
>> running command.
>> The PowerShell SDK topic "How to Create a Console Shell"
>> http://msdn2.microsoft.com/en-us/library/aa965352.aspx shows how to
>> use the -authorizationmanager parameter of make-shell to specify a
>> cutom authorization manager.
>>
>> Am i correct in assuming i have to create a custom shell and deny
>> access to the standard powershell to plug my custom
>> AuthorizationManager into powershell, and that this can/should only
>> be done by creating a custom shell.
>>
>> regards
>> Joris van Lier
>
> forgot to ask:
> Can I define the AuthorizationManager to use when using
> RunspaceInvoke?

Answering my own question: it seems you can specify the AuthorizationManager
by assigning it to the RunspaceConfiguration.AuthorizationManager property ,
then
passing this to RunspaceFactory.CreateRunspace(RunspaceConfiguration)

Adding three more questions:
How do i enforce this RunspaceConfiguration to be applied to every
shell/invokation?
How do i deny invoking shell/runspace without my custom configuration?
Is distribution of such settings via Active Directory possible?

Joris