PHP：访问控制机制的架构
我有一个 PHP 应用程序，它具有基于单个页面的导航 ID 的访问控制机制。例如，用户可以访问第 1、4、5 页。导航 ID 不是静态的，新页面（因此新的导航 ID）可能由管理员用户生成。我有某种面向服务的架构。因此，我的服务可以通过 JSON 从客户端调用，也可以通过 PHP 类（控制器）直接从服务器端调用。我遇到的问题是，我需要服务的访问控制机制。我希望将其与服务本身分开。
这些服务正在返回业务对象。所有这些 BO 都与一个对象有某种“连接”，该对象有一个导航 ID。例如，服务返回图像：Image.page-->Page.navID 或服务返回尺寸 (nn)：Dimension-->DimImageConnector-->Image.page-->Page.navID。
我无法想象一个干净的解决方案来检查访问权限。在业务对象中搜索导航 ID 似乎不是一个很好且简单的解决方案。
如果能为我的访问控制架构提供一些输入，那就太好了。
谢谢你！
顺便说一句：我正在使用注释框架，因此一种可能性是通过服务方法指定一些访问信息。
I have a PHP application which has an access control mechanism based on the navigation-id's of the single pages. So a user may have access to pages 1, 4, 5, for example. Navigation-id's are not static, new pages (and therefore new nav-id's) may be generated by admin-user. And I have some kind of a service oriented architecture. So I have services which are called from the client by JSON but also from server-side by PHP-classes (controllers) directly. The problem I have is, I need a access control mechanism for the services. And I'd like to have it separated from the services itself.
The services are returning business objects. All this BO's have some "connection" to an object, which has a navigation id. e.g. service returns images: Image.page-->Page.navID or service returns dimensions (n-n): Dimension-->DimImageConnector-->Image.page-->Page.navID.
I can't imagine a clean solution to check access rights. To search for a navigation-id in the business objects doesen't seem to be a very good and simple solution.
It would be nice to have some input for my access control architecture.
Thank you!
BTW: I'm using an annotation framework, so one possibility is to specify some access information right by the service method.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我的想法实施起来有点复杂，但我认为它解决了问题。您的请求有一个问题，那就是它与服务本身没有分离。
想象一下这个想法。您有一个基服务类，其中包含 IsCallable 方法，如果当前用户可以调用该服务，则返回该方法。
您从该服务类继承 NonAuthenticatedService 和 AuthenticatedService。完成之后，您只需要创建一个服务工厂来检索服务并调用它们。
在这里，我留下了我的想法的图形化想法。对不起，图形，这只是Power Point，因为我不喜欢CASE Tools。 :)
希望我能提供帮助！
My idea is a bit complicated to implement, but I think it solves the problem. It has one problem with your request, and is that is not separeted of the services per se.
Imagine this idea. You have a base service class with a method IsCallable returning if the current user can call the service.
From that service class you inherit, NonAuthenticatedService and AuthenticatedService. After you have that, you need only to create a service factory to retrieve services and call them.
Here I leave a graphical idea of my toughts. Sorry for the graphics, it's just Power Point, because Im not a fan of CASE Tools. :)
Hope I can help!
如果导航 ID 发生变化并且权限基于导航 ID，那么您必须在所有导航 ID 发生变化时重新映射它们。
也许最简单的方法是建立一个将用户与页面（而不是导航ID）相匹配的表。您可以修改已有的表或创建一个新表。然后有另一个表将页面映射到其当前的导航 ID。要检查用户是否具有访问权限，请连接两个表。
然后您需要做的就是在导航 ID 发生变化时更新映射表。
我建议研究一种导航 ID 不会改变的方法。或者，添加与 nav-id 一起使用的静态 ID。这样您就可以只引用静态 ID，并让导航 ID 根据需要进行更改。
If the nav-ids change and permissions are based on nav-ids then you'll have to remap all the nav-ids whenever they change.
Probably the easiest method would be to have a table that matches users to pages (not nav-ids). You might modify what you have or create a new table. Then have another table that maps the pages to their current nav-id. To check whether a user has access, you join the two tables.
Then all you need to do is update the mapping table whenever the nav-ids change.
I would recommend investigating a method by which the nav-ids will not change. Alternatively, add a static id to be used with the nav-id. That way you can just reference the static ids and let the nav-ids change as much as they want.