现有的细粒度访问控制库/框架？
假设我有这样的需求：
角色 AA 中的用户 A 需要能够更新类型 A1 的所有实体。
角色 BB 中的用户 B 需要能够仅更新主标识符为“2”的 A1 类型实体，我将其称为 A1(“2”)，并且不能更新 A1 类型的任何其他实体，但是可以向实体 A1（“2”）添加或删除任意数量的 B2 类型的子实体。
角色 CC 中的用户 C 需要能够编辑属于实体 A1(“2”) 的这些子 B2 实体的大部分属性，但不是全部属性，角色 CC 的成员也不能从 A1(“2”) 添加或删除 B2 实体）。
用户 D 位于角色 BB 和角色 CC 中，并且由于成员身份组合，因此具有从两组权限的并集派生的权限（在本例中，因为角色 CC 权限是角色 BB 的真子集，因此意味着用户 D 可以执行角色 BB 允许的所有操作）。
等等。这些策略可能在部署后发生更改，因此不需要进行重大的重新开发工作来实施更改（就像解决此问题的声明性方法可能需要的那样）。
我假设访问控制列表 (ACL) 将存储在受保护的对象旁边或内部。
我认为编写代码的开发人员需要能够命令式（而不是声明式）查询单个方法/函数/操作/过程，并使用标识当前主体、正在考虑的对象、正在考虑的操作的参数（也许我们称之为权限），然后检索一个布尔值，指示是否应允许或拒绝该操作。
请随意挑战我的假设。
现在，我已经有了一个简单而有效的专有通用解决方案（基于我已经致力于生产并且运行良好的工作）。我正在考虑将其作为开源项目发布。
但在我将其提升到一个新的水平并构建这个野兽之前，我想知道是否有人知道一个广泛接受的系统、模块或库（不一定必须是 .NET），它已经帮助开发人员实现这种类型对实体的细粒度控制（无论是数据库记录还是 ORM 中的对象或其他内容）。
PW 在将其发布到 SO 之前查看答案时，我在其他地方找到了答案（SO LINK ）表明 Zend_Acl 对于 LAMP 项目可能具有这种功能，但我更喜欢 .NET/Windows 解决方案。
Let's say I have these kind of requirements:
User A in Role AA needs to be able to update all entities of type A1.
User B in Role BB needs to be able to update only the entities of type A1 with the primary identifier of "2", which I'll call A1("2"), and can not update any other entities of type A1, but can add or delete any number of child entities of type B2 to entity A1("2").
User C in Role CC needs to be able to edit most but not all of the properties of these children B2 entities belonging to entity A1("2"), nor can members of Role CC add or remove B2 entities from A1("2").
User D is in Role BB and Role CC, and as a result of the combined memberships, has the permissions derived from a union of the two sets of permissions (in this case, because Role CC permissions are a proper subset of Role BB, this means User D can do everything allowed for Role BB).
And so on. These policies may be changed after deployment, and so should not require major re-development work to implement the changes (like what might be required for a declarative approach to solving this problem).
I'd assume that access-control lists (ACLs) would be stored alongside or inside the objects being protected.
I presume that the developer writing the code needs to be able to imperatively (not declaratively) query a single method/function/operation/procedure, with arguments identifying the current principal, the object under consideration, the operation being considered (maybe we call this the privilege), and then retrieve a single boolean value indicating whether the operation should be allowed or denied.
Feel free to challenge my assumptions.
Now, I already have a simple yet effective proprietary general solution in mind (based on work I've already committed to production and is working quite well). I am considering publishing this as an open-source project.
But before I take it to the next level and build this beastie, I wondered if anyone knew of a widely-accepted system, module, or library (doesn't necessarily have to be .NET) which already assists developers with implementing this kind of fine-grained control over entities (whether that means database records or objects in an ORM or whatever).
P.W. In reviewing answers before posting this to SO, I found an answer elsewhere (SO LINK) that suggested Zend_Acl might have this kind of capability for LAMP project, but I would prefer a .NET/Windows solution instead.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
事实证明，我需要的东西（不知道为什么我之前没有看到它）是 Windows AzMan。花了一些工作来弄清楚如何做可继承的 ACL 之类的事情，但通过对范围的一些创造性使用，我拥有了一个非常易于管理、灵活且快速的系统。
AzMan 非常震撼，但它的文档还有一些不足之处。
Turns out that the thing I needed (and don't know why I didn't see it before) was Windows AzMan. It took a little of work to figure out how to do something like an inheritable ACL, but with some creative use of scopes, I have a pretty manageable, flexible, and fast system.
AzMan totally rocks, but its documentation leaves a little to be desired.
Rhino Security 值得一看。可能会改变你的假设...
Rhino Security is worth a look. Might change your assumptions...