我什么时候应该在应用程序中使用 ACL
我对何时应该在应用程序中实现 ACL（访问控制列表）系统感到非常困惑，尽管我只需获取会话组 ID 并使用限制访问即可轻松管理组的权限验证组件。
ACL 解决方案如何比我上面讨论的方法（根据组 ID 限制组访问）更好？
在管理应用程序中的访问权限时，实施 ACL 解决方案如何简化事情？
到目前为止，我已经了解到，通过 ACL，可以在运行时授予和撤销权限，但不使用 ACL 也可以实现此功能。
我对此非常困惑，请帮助我理解这个概念、何时使用 ACL 以及在 Web 应用程序中使用 ACL 的好处。
我更喜欢使用 cakePHP v1.3 进行编码，因此如果在 cakephp 的上下文中给出解释那就太好了，但非常感谢与我的问题相关的任何帮助（独立于语言/技术）。
I am pretty much confused as to when I should implement an ACL (access control list) system in my application though I can easily manage permissions on groups simply by fetching the session group id and restricting the access using the Auth component.
How is an ACL solution better then the approach I discussed above (restricting the group access based on group id) ?
How does implementing an ACL solution simplify things when it comes to managing access rights in your application ?
Till now I have learned that through ACL, permissions can be granted and revoked at runtime, but this functionality is also achievable without using an ACL.
I am very much confused about this, please help me understand the concept, when to use ACL and the benefits of using ACL in your web application.
I prefer to code with cakePHP v1.3 so it would be great if the explanation is given in context of cakephp but any help (language/technology independent) related to my question is greatly appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您需要控制对动态变化的各个实体的访问，则必须使用 ACL（或等效的用户权限机制，例如文字数据库用户和权限表）而不是组。文件系统将 ACL 附加到各个文件，因为您不想为每个文件创建单独的组。出于同样的原因，数据库管理员将 ACL 附加到数据库、表、视图、存储过程等。 Web 服务器以相同的方式处理 Web 应用程序。
在处理业务实体的业务应用程序中，您可能希望划分对实体的访问，例如公司内的不同销售订单、客户、产品或部门，其中并非每个人都被允许创建/更新甚至读取相同的实体。例如，当销售人员直接争夺奖金时，他们不希望其他人看到有关其 CRM 存储的潜在客户的所有信息。
不过，通常情况下，您希望保持访问机制尽可能粗粒度：组通常就足够好了。细粒度的访问控制机制有变得复杂、昂贵、不准确且难以正确使用的趋势。它们甚至可能降低安全性，因为管理上的挫败感会鼓励人们寻找聪明的解决方法......
You must use ACLs (or an equivalent user permission mechanism such as literal database User and Permission tables) rather than groups if you need to control access to individual entities which vary dynamically. File systems attach ACL's to individual files since you don't want to create a separate group for each file. Database managers attach ACL's to databases, tables, views, stored procedures and whatnot for the same reason. Web servers deal with web applications in the same manner.
In a business application dealing with business entities, you may want to partition access to entities such as e.g. different sales orders, customers, products or divisions within your company, where not everybody is allowed to create/update or even read the same entities. For instance, when sales staff are in direct competition for bonuses, they don't want everybody else to see all the information on their CRM-stored prospects.
Usually, though, you want to keep your access mechanisms as coarse-grained as is humanly possible: groups are usually good enough. Fine-grained access control mechanisms have a tendency to grow complex, expensive, inaccurate and hard to use correctly. They may even decrease security, since administrative frustration encourages people to find clever workarounds...
我认为用于保护用户对资源的访问的 ACL 技术仅对典型或中型应用程序有用。对于像CRM或金融数据仓库这样的大型应用程序，ACL将无法管理一组非常复杂的用户/资源对，当数据的大小、类型和数量增加时，为此目的制作的ACL表也会增加，这对我来说，使用 ACL 表使数据库服务器超载是没有意义的。还有许多其他技术用于安装安全访问、权限和特权...使用 ACL 文件听起来不错，但这不是一个好主意，因为文件可能会不时损坏，因此数据故障的风险超过了无法访问包含 ACL 规则的文件或访问不存在的文件或丢失的文件...使用权限的唯一方法是使用在上下文中或应用程序的目的中使用的业务表以及之间的关系如果您处于 MVC 架构或任何其他架构下，您的表和一些要添加到服务端脚本中的逻辑...因此，请避免对非常大的应用程序使用 ACL。
I think that ACL technic for securising user access to ressources is usefull only for a typical or medium - sized application . for big applications like CRM or financial data warehouses , ACLs will fail to manage a very complex set of user / ressource couples , when the data increase in size , in type and in volume , the ACLs tables made for that purpose will increase too , which it make for me no sense to overload the database server with ACL Tables. There are many others technics used to install security access and permissions and privileges ... The use of ACL files instead does not sound bad but it is not a good idea as files may corrupt from time to time so data failure is over the risk to not have access to a file containing ACL rules or to access a non existing file or a lost one ... The only way to play with permission is to use the business tables used in the context or in the purpose of your application with relationships between your tables and some logic to add to your Service Side Scripts if you are under MVC Architecture or any else ... So Avoid using ACL for very big sized applications.