安全对象模型.net
我正在尝试为我的应用程序构建一个简单的基于用户名-密码-角色的安全对象模型。要求是用户将使用用户名和密码输入，并且他/她将根据他们所属的角色启用和禁用对系统部分的访问。我认为这是相当简单的想法。
现在这是我的查询。我在业务对象中有一个基类，它被所有其他类继承。在我的安全项目中，会有几个类，例如安全、身份（包含用户配置文件信息）等。这个想法是我的基类将使用此安全对象，继承的类可以为给定（登录）用户引用此安全对象。因此，例如，如果我登录到应用程序并访问帐户模块，因为帐户模块继承了我的基类，它知道我是谁，我属于什么角色等。因此我可以在其中拥有一个属性 CanExecute我的帐户模块可以根据用户的角色打开/关闭。
希望我尽量把这一点说清楚。我真的很乐意接受编码和架构方面的任何投入。
非常感谢， 普雷亚什
I am trying to build a simple username-password-role based security object model for my application. The requirement is that user will enter using username and password and he/she will have enable and disable access to the part of the system depending upon whatever role they fall into. which I think is fairly simple idea.
Now here my query. I have a base class in business object which gets inheriates by all other classes. In my security Project there will be few classes for e.g. Security, Identity (which contains userprofile info) etc. The idea is that my base class will use this security object and the inheriated classes can reference this security object for a given (loggedin) user. So for e.g. if I am logged into the application and I went to access the accounts module , becouse account module inheriates my base class it has the knowlege about who am I, what role I fell into etc. Hence I can have a property CanExecute in my accounts module which can be turned on/off depending upon the user's role.
Hope I tried to make this clear as possible. I really would appriciate any inputs in terms of coding and in terms of architecute.
Many thanks,
Preyash
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
.net 内置了此类内容。查找 GenericPrincipal 和授权。 ASP.NET 还内置了身份验证。
例如： http://www.15seconds.com/issue/041208.htm 和这里：http://www.codeproject.com/KB/security/SecurityModelDotNet.aspx
应该让你开始
.net has this kind of stuff built in. Look up GenericPrincipal and authorization. Also ASP.NET has Authenication built in .
For example : http://www.15seconds.com/issue/041208.htm and here : http://www.codeproject.com/KB/security/SecurityModelDotNet.aspx
Should get you started
activebiz，
回顾一下上面的内容：
我认为您可能应该使用内置的 FormsAuthentication & MembershipService 类，因为这还为您提供（免费）所有控制器和操作装饰器 [Authorize] 等，这将允许您立即在控制器级别执行您想要的操作。
此外，您还可以使用身份验证票证等。您还可以构建一个自定义配置文件提供程序，它允许您将用户表直接绑定到配置文件公共类中。关于这个东西有很多很好的链接。
如果您觉得这可能是更好的下降路线，我稍后会查看这些内容。
[编辑]链接如承诺。当我找到它们时会添加。
这里有一个针对初学者的 SO：
在 ASP.NET MVC 中实现配置文件提供程序
以及我的老朋友 lee dumond 的一篇：
http: //leedumond.com/blog/asp-net-profiles-in-web-application-projects/
activebiz,
to recap from above:
i think you probably should use the built-in FormsAuthentication & MembershipService classes as this also gives you (for free) all the controller and action decorators [Authorize] etc, which will allow you to do what you want at contoller level straight away.
also, you get to use the authentication tickets, etc, etc. you can also build a custom profileprovider that will allow you to tie your user table directly into the profilecommon class. there are lots of good links on this stuff.
i'll look those out a bit later if you feel this might be a better route to go down.
[edit] links as promised. will add to as i find them.
here's one on SO for starters:
Implementing Profile Provider in ASP.NET MVC
and one from my old mate, lee dumond:
http://leedumond.com/blog/asp-net-profiles-in-web-application-projects/