JavaEE/JaaS 的属性/域安全性？
RBAC很好理解，所以这超出了RBAC的范围。
寻找一种有效/经过测试的方法来处理基于属性或域的安全性，以便主体可以具有 N 个属性（具有 N 个值），这将限制他们可以看到或不能看到的内容。我知道 acegi 可以处理这个问题，但是通过替换 JAAS，我想评估是否有一种方法可以与 JAAS 一起处理这个安全模型。
例如：
乔喜欢苹果、橙子、梨。
约翰喜欢橙子和西红柿。
简喜欢苹果，但对西红柿过敏（明确否认对西红柿过敏）。
您提供数百种蔬菜和水果，并且专注于每种水果和蔬菜的特殊品种。
如果某人有权查看苹果，他们可以看到所有专门的苹果，例如“奶奶史密斯”，但如果他们没有“喜欢”属性/权限，则不允许查看其他专门类型。
从技术上讲，每个主体都有与其关联的各种属性，这将限制它们从各种数据调用/更新中看到的内容，并寻找一种干净的方法来支持在 JavaEE 设置（ejb/servlet）中使用主体的这些属性）。
提前致谢！
RBAC is well understood, so this is beyond RBAC.
Looking for an efficient/tested approach to deal with attribute, or domain, based security such that a principal may have N attributes (with N values) that will limit what they can or can not see. I understand acegi can handle this, but by replacing JAAS, and I would like to evaluate if there is a way to work with JAAS to deal with this security model.
Examples:
joe likes apples, oranges, pears.
john likes oranges and tomatoes.
jane likes apples but is allergic to tomatoes (explicitly denied from tomatoes).
You serve 100's of vegetables and fruits, and you specialize in special varieties of each fruit and vegetable.
If someone has permission to see apples, they can see all the specialized apples like 'granny smiths' for example, but not allowed to see other specialized types if they do not have that 'likes' attribute/permission.
Technical, each principal has various attributes associated with them, that will limit what they are allowed to see from various data calls/updates and looking for a clean way to support having those attributes with the principal be used in a JavaEE setting (ejb/servlet).
thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
JAAS 没有指定 Java EE 容器应该如何（或者是否）实现这一点。因此，各种包含对此有（或没有）自己的支持。
因此，如果您希望它与 JAAS 一起工作，那么解决方案将是特定于容器的，或者是一个附加库，例如 acegi。
JAAS does not specify how (or even if) a Java EE container should implement this. Therefore various contains have (or don't have) their own support for this.
Because of this, if you want it to work along with JAAS, then the solution will be container-specific, or will be an add-on library such as acegi.