Spring Security - 动态角色
我的应用程序中有一个用户需要按类别公开一些数据。
例如：
具有 ROLE_CAMPAIGN 的用户 A 只能查看其中广告活动_category_id = 5
具有 ROLE_CAMPAIGN 的用户 b 只能看到 WHERE 广告系列_category_id IN(5,10,4)
（选择、插入、更新、删除）
用户和营销活动是休眠实体。
他们的连接是ManyToMany（用户有CampaignsCategories）
如果我将其转换为本机 SQL
SELECT * FROM CAMPAIGNS WHERE CATEGORY_ID IN (SELECT ID FROM USER_CATEGORIES)
等等。
对具有某种角色的用户实现动态的正确方法是什么？
小例子会有帮助。
（春季安全3）
I have a user in my application that needs to be exposed to some data by category.
for example:
user A with ROLE_CAMPAIGN can see only WHERE campaign_category_id = 5
user b with ROLE_CAMPAIGN can see only WHERE campaign_category_id IN(5,10,4)
(select,insert,update,delete)
User and Campaign are hibernate entities.
their connection is ManyToMany (User has CampaignsCategories )
If I translate that to native SQL
SELECT * FROM CAMPAIGNS WHERE CATEGORY_ID IN (SELECT ID FROM USER_CATEGORIES)
and on and on.
What is the correct way to implement dynamic to a user with some role.
Little example will help.
(Spring security 3)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
看起来您可以使用访问控制列表 (ACL) 来解决此问题：2 名员工具有相同的 ROLE_EMPLOYEE，并且无法执行管理员可以执行的操作，但在该范围内，他们不允许查看或删除彼此的记录。
http://static.springsource.org /spring-security/site/docs/3.0.x/reference/domain-acls.html 应该给你一个更好的主意。
It looks like you could use the Access Control Lists (ACL) for solving this issue: 2 employees have the same ROLE_EMPLOYEE and can't do what an admin can, yet within that perimeter they are not allowed to see or delete each other's record.
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/domain-acls.html shoud give you a better idea.
您正在寻找针对安全模型缺陷的技术解决方案。
具有相同角色的人员应该具有相同的访问权限。
如果您发现您的安全决策不遵循此条件，那么您需要重新定义角色以使其更细化。
You are looking for a technical solution to a security model shortcoming.
People in the same roles should have the same access.
If you find that your security decisions do not follow this condition then you need to redefine roles to be more granular.
角色不是您正在寻找的答案。正如 Emanuel 所说，访问控制列表可以解决您的问题。 Spring security 当配置为使用角色时，无法本机区分具有相同角色的两个用户。
Roles is not the answer that you are looking for. Access Control Lists is the solution to your problem as stated by Emanuel. Spring security when configured to use roles, cannot natively distinguish between two users having same roles.
通常，RBAC 不能为每个受控实体授予不同的权限。 RBAC 是二维的 - 权限 X 角色。通常没有任何机制来测试哪些内容受到控制。您可能可以为此使用 RBAC，但这需要大量的角色来完成，并且需要进行一些自定义，而且您最终还是会创建一个 ACL。
另一方面，ACL 本质上是 3 维的 - 权限 X 角色 X 对象都能够在完整集或部分集中相互定义：
权限 X 角色 X 对象（完整的 ACL）
权限 X 角色 (RBAC)
角色 X 对象（有用吗？）
权限 X 对象（有用吗？）
ACL 和 RBAC 都允许为人员分配不同的角色。大多数 RBAC 不允许以任何其他方式分配权限。
然而，许多 ACL 能够直接向人员分配特定对象/实体的权限。如果这是 ACL 的能力，那么它会增加大量的灵活性，但会大幅增加复杂性并降低速度。专门为一个人创建一个角色要好得多。因此，不要直接向人们分配权限。
您的问题主要是您没有区分角色的类型，但 RBAC 无论如何也不会为您做这件事。您应该使用 ACL。如果您可以设置权限与角色以及角色与对象的表格显示，您将可以更长时间地理解。
大多数优秀 ACL 还具有一个元素：对象组。这就是您需要进行批量或“随行”权限分配的情况。您的营销活动创建代码将按类别预先分配组，然后角色和权限就会自然发生。
NORMALLY, RBACs cannot give different permissions per controlled entity. RBACs are two dimensional - Permissions X ROLE. There are not usually any mechanisms for testing which content is being controlled. You could probably use an RBAC for this, but it would take a lot of ROLES to do it, and some customizations and you'd end up creating an ACL anyways.
ACLs on the other hand, inherently are 3 dimensional - Permissions X ROLES X Object are all capable of being defined against each other in full sets, or partial sets:
Permissions X ROLE X Object (ACL in full)
Permissions X ROLE (RBAC)
ROLE X Object (useful?)
Permissions X Object (useful?)
BOTH ACLs and RBACs allow assigning people different ROLES. MOST RBACs don't allow assigning permissions any other way.
However, many ACLs have the ability to assign permissions directly to people in regards to specific Objects/Entityes. If this is a cpability of an ACL, it adds a great deal of flexibilty at a huge increase in complexity and loss of speed. it's far better to just create a ROLE specifically for one person. So don't go there with direct assignment of permissions to people.
Your problem is MOSTLY that you aren't differentiating the types of ROLES, but an RBAC wouldn't do it for you anyway. You should use an ACL. If you can set up a tabular display of permissions vs ROLE, and ROLE vs object, you'll keep your understanding longer.
One more element that most good ACLs have: Groups of Objects. That is what you need to do bulk or 'as you go' assignments of permissions. Your creation code for Campaigns would pre assign the groups by the category, and the ROLES and permissions would then happen naturaly.