数据相关安全实施
使用 Shiro，我们在 GF 上运行的企业应用程序中嵌入了一个出色的安全框架。您定义用户、角色、权限，我们可以在任何细粒度级别控制用户是否可以访问应用程序、特定页面甚至单击特定按钮。
除此之外，是否有一种方法或模式可以限制用户查看某些数据？
示例：您有 3 个工厂（隶属于一家公司）的客户表。管理员用户可以查看所有客户记录，但本地工厂的用户不得查看其他工厂的任何客户数据（无论出于何种原因）。
安全功能应该是角色定义的一部分。
感谢您的任何意见和想法
Using Shiro we have a great security framework embedded in our enterprise application running on GF. You define users, roles, permissions and we can control at any fine-grain level if a user can access the application, a certain page or even click a specific button.
Is there a recipe or pattern, that allows on top of that, to restrict a user from seeing certain data ?
Sample: You have a customer table for 3 factories (part of one company). An admin user can see all customer records, but the user at the local factory must not see any customer data of other factories (for whatever reason).
Te security feature should be part of the role definition.
Thanks for any input and ideas
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
向您的应用程序添加一个或多个安全表，其中包含
UserID以及包含要安全化资源的表主键的外键。在新表中为要授予访问权限的每个用户/资源组合创建记录。
然后，当从数据库请求资源时，只需使用资源键将安全表连接到资源表，并根据当前登录用户的安全表的
UserID进行过滤。这将修剪输出，删除用户无权访问的任何记录。创建允许您在安全表中设置新记录以授予用户访问资源的表单相对简单。
注意：在您提到的特定情况下，您只需要用户数据库中的一个字段来保存用户有权访问的客户数据库中的主键值。
Add one or more security tables to your application that contain
UserIDand a foreign key to the Primary Key of the table containing the resource to be securitized.Create records in the new table for each User/Resource combination that you want to grant access.
Then, when the resource is requested from the database, just join the security table to the resource table using the Resource keys, and filter on the
UserIDof the security table for the user that is currently logged in. This will trim the output, removing any records for which the user does not have access.It is relatively straightforward to create forms that allow you to set up the new records in the security table granting users access to resources.
NOTE: In the specific case that you mentioned, you just need a field in the User database that holds the value of the Primary Key in the customer database for which the user has access.