ActiveDirectoryMembershipProvider 和 SqlRoleProvider：维护？
在一个新项目中，我计划使用 ActiveDirectoryMembershipProvider 和 SqlRoleProvider 分别提供身份验证和授权。
我不清楚的一件事是如何处理维护 - 当已登录并被分配角色的用户从 Active Directory 中删除时，如何删除 SqlRoleProvider 使用的映射表中的孤立记录？我相信这是 aspnet_UsersInRoles 表。
人们可以定期查询 Active Directory 中是否有禁用的用户，然后调用 Roles.RemoveUserFromRoles(UserId, Roles.GetRolesForUser(UserId)) 迭代该列表，其中 UserId 也在 aspnet_UsersInRoles 中。我想，对于一个大型组织来说，速度非常慢。
或者，对于 UsersInRoles 中的每个不同 UserId，查询 ActiveDirectory 并确保 userAccountControl 属性的位掩码不表明该帐户已被禁用。对于大量应用程序用户来说，效率也非常低。
一种更丑陋但更有效的方法是存储上次登录日期并定期清除六个月未登录的用户的角色关联。这可能会导致头痛。
我很想听听建议。
In a new project, I'm planning to use ActiveDirectoryMembershipProvider and SqlRoleProvider to provide authentication and authorization, respectively.
One thing that isn't clear to me is how maintenance is handled -- when users that have logged in and been assigned roles are removed from Active Directory, how do you remove orphaned records in the mapping table used by SqlRoleProvider? I believe this is the aspnet_UsersInRoles table.
One could query Active Directory periodically for disabled users, then iterating through that list calling Roles.RemoveUserFromRoles(UserId, Roles.GetRolesForUser(UserId)) where UserId is also in aspnet_UsersInRoles. Hugely slow, I would imagine, for a large organization.
Or, alternatively, for each distint UserId in UsersInRoles, query ActiveDirectory and ensure the userAccountControl attribute's bitmask doesn't indicate the account is disabled. Also very inefficient, for a large number of application users.
An even more ugly but much more efficient approach would be to store last login date and periodically purge role associations for users that haven't logged in for, say, six months. This might cause headaches.
I'd love to hear suggestions.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是的，您必须手动进行清理。您需要即时更新吗？如果您可以执行每晚运行的批处理过程，那么这将是高效的，因为它不在核心运行时间内运行。或者，一旦您意识到这一点，就可以在另一个线程中启动一个进程来处理角色的删除，这可能是有意义的。删除每个用户访问的角色会在用户之间共享影响，并使他们认为应用程序很慢。
角色被删除了多少次？如果很多，那么考虑批处理，如果几年一次，那么在某个过程中将其添加到应用程序中可能不是那么大的问题。
至于如何操作，您可以使用 API，但 aspnet_UsersInRoles 和 aspnet_roles 表也可以通过 SQL 脚本轻松地自行擦除。
HTH。
Yes, you have to manually do the cleanup. Do you need instantaneous update? If you can do a batch process that runs nightly, that would be efficient since it isn't running during core operational hours. Or, it might make sense to kick off a process in another thread to handle the deletion of the role as soon as you are aware of it. Removing roles per user access shares the hit across users and makes them think that the application is slow.
How many times are roles removed? If a lot, then consider a batch process, if once in a few years, then it probably isn't as much of an issue to work it into the application during some process.
As far as how too, you can use the API, but the aspnet_UsersInRoles and aspnet_roles tables could be easily wiped on their own accord too via SQL Script.
HTH.