Java EE 角色管理系统 - 它们存在吗？
我正在考虑创建一个与 Java EE 角色集成的分散式角色管理系统。有这样的事情存在吗？
示例用例：
系统 A 是一个使用企业角色的访问受限系统。 John 加入一个团队，并需要 SYSTEM_A_READONLY 来执行他的功能。他登录到分散的角色管理系统，并发出 SYSTEM_A_READONLY 请求。 Bill 是系统 A 的管理员，并收到 John 已申请此访问权限的通知。然后，他可以登录到同一系统并批准该请求。 John 现在可以访问系统 A。
系统 B 是一个敏感的客户管理系统。它为其服务的每家公司分配 1 个角色。目前它有 SYSTEM_B_CLIENT_FOO、SYSTEM_B_CLIENT_BAR 等。Greg 是该系统的管理员，销售团队通知他 TNT 已作为客户登录。他登录到角色管理系统，并添加新客户端。 Web 应用程序 C（远程托管，但仍使用公司角色）检测新角色，并将其添加为用户的选项。
希望这是有道理的。我已经考虑过自己制作它，但这似乎是一个很常见的要求。
I'm looking at creating a decentralized role-management system which integrates with Java EE roles. Does anything like this exist?
Example use cases:
System A is a limited-access system which uses corporate roles. John joins a team, and requires SYSTEM_A_READONLY to perform his function. He logs on to the decentralised role-management system, and puts in a request for SYSTEM_A_READONLY. Bill is the administrator for System A, and receives a notification that John has applied for this access. He can then log on to the same system and approve the request. John now has access to System A.
System B is a sensitive customer management system. It has 1 role for each company that it serves. Currently it has SYSTEM_B_CLIENT_FOO, SYSTEM_B_CLIENT_BAR, etc. Greg is the administrator for this system, and he is notified by the sales team that TNT have signed on as a customer. He logs on to the role management system, and adds the new client. Web Application C (hosted remotely, but still using corporate roles) detects the new role, and adds it as an option for it's users.
Hope that makes sense. I've looked into making it myself, but it seems like a requirement that must be quite common.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
我认为这样的事情不存在。这个要求确实似乎很常见，但我认为外表是具有欺骗性的。每个公司，无论是（范围）应用程序，都会对管理用户和角色的界面有非常具体的要求。
根据要求，设置也可能相当简单。如果“提出请求”仅意味着“向管理员发送电子邮件”，而“添加客户端”意味着使用简单的 CRUD 框架生成的管理员登录并填写表格，那么您就已经完成了。
I don't think anything like this exists. The requirement indeed seems quite common, but I think appearances are deceiving. Every company, for ever (range of) application(s), will have very specific requirements concerning the interface to administer users and roles.
Depending on the requirements, it may also be reasonably simple to set up. If 'putting in a request' simply means 'an email is sent to the admin' and 'adding the client' means logging in using a simple, CRUD-framework generated, admin and filling out a form, then you are already done.
你可以看看 Apache Shiro http://incubator.apache.org/shiro/ 虽然我'我不确定它是否已准备好迎接黄金时段或完全满足您的开箱即用需求。
您可以使用 Spring Security 开发授权组件，特别是通过实现您自己的 AccessDecisionVoter 和 UserDetailsService。实体、持久性和 Web UI 组件非常简单，您可以在您熟悉的任何框架中执行这些操作。
You could look at Apache Shiro http://incubator.apache.org/shiro/ although I'm not sure it's either ready for prime time or completely does what you're looking for out of the box.
You could develop the authorization components using Spring Security, specifically by implementing your own AccessDecisionVoter and UserDetailsService. The entities, persistence and web ui components are pretty straightforward, you could do those in whatever framework you're comfortable with.
有一些产品可以帮助您 - 比如 bea 的 crosslogix。
这些通常是逻辑决策引擎，可让您制定复杂的规则，允许角色和权限等内容进行嵌套和分层。它们（通常）还允许参数化权限检查，例如如果是该月的最后一周，则用户处于角色 ACCOUNT_APPROVER。
“检测新角色”通常是拥有集中式系统的副产品 - 即一切都只是查询它，并且 API 非常快，专门使查询成为“廉价”操作。
他们通常不太擅长（我猜是因为他们认为这不属于他们的领域）是围绕批准对这些角色的访问的工作流程。他们通常会为您提供一个控制台（和一个 API）来修改它们，但将批准工作流程留给您。
正如之前的发帖者所说，批准位的问题在于它往往是特定于公司的，因此它通常被保留为 API。
简而言之 - 像 crosslogix 这样的东西可以完成你需要的一半 - 决策逻辑，并且大多数产品都为你提供了一个简单的超级控制台来管理权限逻辑，但如果你想要公司特定的批准逻辑 - 你会可能必须在上面剥一个网站的皮肤。
-高手
There are some products out there to help you - things like crosslogix from bea.
These are generally logic decision engines that let you craft complex rules that allow for things like roles and permissions to be nested and hierarchal. they also (generally) allow for parameterized permission checks like user is in role ACCOUNT_APPROVER if it's the last week of the month.
"Detecting new roles" generally comes as a by-product of having the centralized system - i.e everything just queries it, and the API is very fast specifically to make querying a 'cheap' operation.
What they are generally not so good at (I guess as they perceive it's not in their space) is the workflow around approving access to these roles. They'll generally give you a console ( & an API ) to modify them, but leave the approval workflow up to you.
As the previous poster said - the problem with the approval bit is that it tends to be very company specific - so it's often left as an API.
In short - something like crosslogix would do half of what you need - the decision logic, and this, and most products give you a simple uber-console to manage the permission logic, but if you wanted company specific logic for approvals - you'd probably have to skin a website on top.
-ace
嗯，对我来说，这样的系统是存在的，称为 LDAP（LDAP 组通常映射到 J2EE 角色）。但我承认 LDAP 引擎并没有提供您提到的所有设施和工作流程。实际上，我的经验是，这些都是针对每个公司的（可能是因为缺乏“通用”工具），并且大多数时候，我工作过的公司都有自定义管理应用程序和 >自定义API以从应用程序与其交互。
Well, to me, such a system exists and is called LDAP (LDAP groups are typically mapped to J2EE roles). But I admit that LDAP engine doesn't provide all the facilities and workflows that you mentioned. Actually, my experience is that these are specific to each company (maybe because of the lack of "universal" tool) and, most of time, companies I've worked for had custom admin applications and custom APIs to interact with it from applications.
我们使用了与您所要求的非常相似的东西。 Icefaces 的组件具有 renderonUserRole 属性，这可以与 Spring Security 结合来实现您需要的部分功能。 查看此
We have used something very similay to what you are asking . Icefaces has renderonUserRole propery for their components , this can be combined with Spring Security to achive part of what you need. See this