使用 AD 通讯组控制对程序功能的访问时有哪些安全问题？
我对使用 AD 比较陌生，并且我使用组成员资格来控制给定用户在 Web 和桌面应用程序中加载/可见哪些特性和功能。
AD 有安全组和分发组，我正在使用其中的一些来获得角色之间的细粒度区分。
以这种方式使用通讯组应该担心什么？
I'm relatively new to using AD, and I'm using group memberships to control what features and functions are loaded/visible to a given user, both in web and desktop applications.
AD has security groups and distribution groups, and I'm using some of each to get fine-grained discrimination among roles.
What should be my concerns about using distribution groups in this way?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以考虑查看AzMan（授权管理器）。
它可以与活动目录帐户绑定并完全存储在 AD 中。 AzMan 对角色甚至允许的操作提供了更细粒度的控制。简而言之，您将编写应用程序来测试用户是否有权执行特定操作。创建角色时，您可以向该角色分配一项或多项操作。
这将允许您根据需要混合和匹配各种角色的操作，而无需更改代码库。我已经广泛使用它并且效果非常好。
仅使用常规 AD 组的缺点是，您最终可能会拥有数十个甚至数百个（取决于应用程序的复杂性）角色，从而污染 AD 空间。
例如，假设您希望在允许删除帐户之前进行安全检查。在 AzMan 中，您可以创建一个 AccountDelete 操作，并将该操作分配给一个或多个角色，例如管理员、帐户管理员等。
在 AD 中，您必须创建一个新组并将其分配出去。这很快就会变得非常复杂。
You might consider looking at AzMan (Authorization Manager).
It can be tied to active directory accounts and completely stored within AD. AzMan provides a lot more fine grained control over Roles and even Actions allowed. In short you would code your apps to test if the user is authorized for particular Actions. When creating Roles you would assign one or more actions to that role.
This would allow you to mix and match actions in various roles as necessary without having to change your code base. I've used it extensively and it's pretty good.
The downside to just using regular AD groups is that you might end up with dozens or even hundreds (depending on the complexity of your apps) roles that pollute the AD space.
For example, let's say you want to have a security check before allowing an account to be deleted. In AzMan you would create an AccountDelete action and assign that action to one or more roles like Administrator, Account Administrator, etc.
In AD you would have to create a new group altogether and assign it out. This gets very complicated very quickly.