基于模块的安全性
我正在尝试创建一个基于模块级安全性的应用程序。我们的想法是，我们将让用户登录，获取角色，获取这些角色有权访问的页面，然后在这些页面中获取他们有权访问的模块，然后获取他们有权访问的模块内的功能（列表、创建、编辑、删除）。这样，在管理屏幕中，有人可以允许或拒绝组的模块和模块功能。
有没有人见过这样的示例项目或者有任何关于如何实现这个的线索？我真的很想在 n 层架构上尝试这个。
I am trying to create an application that is based on module level security. The idea is we would have a user login, grab there roles, grab the pages those roles have access to then in those pages grab the modules they have access to then the functions inside the modules they have access to (list, create, edit, delete). That way in an admin screen someon could allow or deny modules and module functions to groups.
Has anyone seen any sample projects like this or have ANY clue on how to implement this? I would really like to try this on a n-layer architecture.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
使用基本会员系统创建您的网站。将页面分组到文件夹中，并在每个文件夹中包含 Web.Config 文件来控制访问。这在很大程度上都是开箱即用的功能。您必须编写的唯一自定义代码是在创建管理表单时。
至于细粒度访问，如果他们无法访问页面，他们就无法访问他们的方法...
http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx
更新：
if User.IsInRole("Administrator")。 ..
https: //web.archive.org/web/20181010194753/http://www.4guysfromrolla.com:80/articles/082703-1.2.aspx
在同一页面的代码隐藏中，您可以检查它们的以编程方式发挥作用并相应地显示/启用面板/模块:-)
Create your site with a basic membership system. Group your pages into folders and have Web.Config files in each to control access. This is all out-of-the-box functionality for the most part. The only custom code you would have to write is when creating an admin form.
As for the fine grain access, if they can't access the pages, they can't access their methods...
http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx
UPDATE:
if User.IsInRole("Administrator")...
https://web.archive.org/web/20181010194753/http://www.4guysfromrolla.com:80/articles/082703-1.2.aspx
On the same page, in the code-behind, you can check their roles programmatically and display/enable panels/modules accordingly :-)
我会为您的页面使用基类来实现您描述的效果。在基类中，您可以添加所需的所有可用方法，但在基类中提供授权方法，该方法允许方法根据允许的角色来标识自身。如果您计划好的话，所有这些都可以通过 web.config 进行配置。很多时候，基于“文件夹”的 SQL 成员资格方法不够稳健。
我想作为一个例子，您可以构建自己的（或在 System.Security 命名空间中找到一个）安全枚举来定义访问级别，然后将 AD 中的组（或任何位置）的访问级别映射到枚举。然后，这些方法可以使用针对您的用户对象的安全枚举来确定用户的访问是否允许该功能。
I would use a base class for your pages to accomplish the effect you describe. In your base class you can add all of the available methods you will need, but provide an authorization method within the base class that allows methods to identify themselves based on the roles they're allowed to have. All of this could be configured with the web.config if you plan it down. A lot of times the "folder" based method for SQL membership just isn't robust enough.
I suppose as an example, you could build your own (or find one in the System.Security namespace) security enumeration to define access levels and then map access levels from your groups in AD (or wherever) to the enumerations. The methods could then use the security enumeration against your user object to determine if the user's access allows the function.