There are several frameworks which provide authorization system for you:
Spring Security A highly customizable framework, Spring Security is widely used to handle the authentication and access control (authorization) issues arising in any Enterprise based application developed in Java.
Apache Shiro Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the largest web and enterprise applications.
JAAS (Java Authentication and Authorization Services) JAAS is one of the security APIs that consists of Java packages designed exclusively for user authentication & authorization. Introduced as an optional package in Java SE 1.3, JAAS was later integrated into JDK, starting from JDK 1.4.
OACC This Java application security framework is designed to fine grain (object level) the access control. Its focus is to provide a full-featured API to enforce as well as manage the authentication and authorization needs of an application. It offers complete implementation of a flexible and robust security model.
jCasbin jCasbin is a powerful and efficient open-source access control library for Java projects. It provides support for enforcing authorization based on various access control models.
Keyclock Keycloak is an open-source Identity and Access Management solution targeted towards modern applications and services. It offers features such as Single-Sign-On (SSO), Identity Brokering and Social Login, User Federation, Client Adapters, an Admin Console, and an Account Management Console.
I presume that the question that you are trying to answer is:
Does user u have access to do operation op on object o?
One thing to consider is how are your domain objects and user groups defined from a business perspective (outside of the AC mechanism). For any RBAC implementation, you would need to configure it to tell what your users and user groups are. That will affect your choice of RBAC implementation.
Another (more specific) question: do you need to support override permissions, includes and excludes? Specifically, do you want to be able to support the scenario that object o1 is available to usergroup g1, but not user u1 (who is part of group g1)?
Depending upon the specific answers, jguard (which is built over JAAS) might be a very good option - http://jguard.net/
There are lots of possible solutions, but which one is best (i.e. meets your needs without being too heavyweight or too complicated to implement) depends on your requirements:
Are you talking about access control for a web service, or something else?
What kind of access control are you looking to implement? Based purely on resource URLs, or depending on the state / metadata of the requested entities? Are the roles simple or hierarchical? Do different actions require different roles?
Apache Fortress is ANSI RBAC compliant engine (INCITS 359) and is released under Apache Software license. You can pull it down from here: https://directory.apache.org/fortress/.
发布评论
评论（6）
Spring Security 可能对你有好处。
Spring Security might be good for you.
有几个框架可以为您提供授权系统：
Spring Security
Spring Security 是一个高度可定制的框架，广泛用于处理用 Java 开发的任何基于企业的应用程序中出现的身份验证和访问控制（授权）问题。
Apache Shiro
Apache Shiro 是一个功能强大且易于使用的 Java 安全框架，可以执行身份验证、授权、加密和会话管理。借助 Shiro 易于理解的 API，您可以快速轻松地保护任何应用程序 - 从最小的移动应用程序到最大的 Web 和企业应用程序。
JAAS（Java 身份验证和授权服务）
JAAS 是安全 API 之一，由专为用户身份验证和安全设计的 Java 包组成。授权。 JAAS 在 Java SE 1.3 中作为可选包引入，后来从 JDK 1.4 开始集成到 JDK 中。
OACC
该 Java 应用程序安全框架旨在实现细粒度（对象级别）访问控制。其重点是提供功能齐全的 API 来强制执行和管理应用程序的身份验证和授权需求。它提供了灵活且强大的安全模型的完整实施。
jCasbin
jCasbin是一个强大且高效的Java项目开源访问控制库。它提供基于各种访问控制模型的强制授权支持。
键盘时钟
Keycloak 是一个面向现代应用程序和服务的开源身份和访问管理解决方案。它提供单点登录 (SSO)、身份代理和社交登录、用户联合、客户端适配器、管理控制台和帐户管理控制台等功能。
There are several frameworks which provide authorization system for you:
Spring Security
A highly customizable framework, Spring Security is widely used to handle the authentication and access control (authorization) issues arising in any Enterprise based application developed in Java.
Apache Shiro
Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the largest web and enterprise applications.
JAAS (Java Authentication and Authorization Services)
JAAS is one of the security APIs that consists of Java packages designed exclusively for user authentication & authorization. Introduced as an optional package in Java SE 1.3, JAAS was later integrated into JDK, starting from JDK 1.4.
OACC
This Java application security framework is designed to fine grain (object level) the access control. Its focus is to provide a full-featured API to enforce as well as manage the authentication and authorization needs of an application. It offers complete implementation of a flexible and robust security model.
jCasbin
jCasbin is a powerful and efficient open-source access control library for Java projects. It provides support for enforcing authorization based on various access control models.
Keyclock
Keycloak is an open-source Identity and Access Management solution targeted towards modern applications and services. It offers features such as Single-Sign-On (SSO), Identity Brokering and Social Login, User Federation, Client Adapters, an Admin Console, and an Account Management Console.
我认为您想要回答的问题是：
用户u是否有权对对象o执行操作op？
需要考虑的一件事是如何从业务角度（在 AC 机制之外）定义域对象和用户组。对于任何 RBAC 实施，您需要对其进行配置以告知您的用户和用户组是什么。这将影响您对 RBAC 实施的选择。
另一个（更具体的）问题：您是否需要支持覆盖权限、包含和排除？具体来说，您是否希望能够支持对象 o1 对用户组 g1 可用但对用户 u1（属于组 g1 的一部分）不可用的场景？
根据具体答案，jguard（基于 JAAS 构建）可能是一个非常好的选择 - http: //jguard.net/
I presume that the question that you are trying to answer is:
Does user u have access to do operation op on object o?
One thing to consider is how are your domain objects and user groups defined from a business perspective (outside of the AC mechanism). For any RBAC implementation, you would need to configure it to tell what your users and user groups are. That will affect your choice of RBAC implementation.
Another (more specific) question: do you need to support override permissions, includes and excludes? Specifically, do you want to be able to support the scenario that object o1 is available to usergroup g1, but not user u1 (who is part of group g1)?
Depending upon the specific answers, jguard (which is built over JAAS) might be a very good option - http://jguard.net/
APACHE SHIRO Java安全框架
它使用基于角色的授权访问控制
APACHE SHIRO Java Security Framework
It is using Role Based Access Control on Authorization
有很多可能的解决方案，但哪一种最好（即满足您的需求而又不会太重量级或太复杂而难以实现）取决于您的要求：
您是在谈论 Web 服务的访问控制还是其他什么？
您希望实施哪种访问控制？纯粹基于资源 URL，还是取决于所请求实体的状态/元数据？角色是简单的还是分层的？不同的操作需要不同的角色吗？
你还需要处理授权吗？
There are lots of possible solutions, but which one is best (i.e. meets your needs without being too heavyweight or too complicated to implement) depends on your requirements:
Are you talking about access control for a web service, or something else?
What kind of access control are you looking to implement? Based purely on resource URLs, or depending on the state / metadata of the requested entities? Are the roles simple or hierarchical? Do different actions require different roles?
Do you need to deal with authorization as well?
Apache Fortress 是符合 ANSI RBAC 兼容的引擎 (INCITS 359)，并根据 Apache Software 许可证发布。您可以从这里下载它：https://directory.apache.org/fortress/。
Apache Fortress is ANSI RBAC compliant engine (INCITS 359) and is released under Apache Software license. You can pull it down from here: https://directory.apache.org/fortress/.