ASP.NET MVC 中基于组的授权
我有管理员、用户等站点角色，这很好。
但假设我有一个合法的申请（或类似的申请）。我有一个名为 Case 的实体。现在，我可以有很多案例，但并非所有用户都应该有权访问任何特定案例。假设 Fred 和 Tom 应该有权访问 Case1，但只有 Gina 和 Rebecca 应该有权访问 Case2？
很简单，对吧？我们有案例，用户可以属于一个案例。这是第一部分。第二部分是如何拥有“案例角色”，以便 Fred 可以成为 Case1 的“管理员”并能够进行重大更改，但 Tom 可能只是 Case1 的“用户”，只能做一些小事情并且具有只读权限 我知道我可能需要实现自定义属性等
，但我在网上找不到任何此类特定事物的示例。但我想这在大多数商业应用程序中一定很常见。 （如 Basecamp 或 Highrise 等）
更新 让我举一个不同的例子：
将项目管理软件作为服务应用程序，如 Basecamp。用户可以创建一个“项目”。然后该用户可以邀请其他用户加入她的“项目”。但是，创建用户可以为其项目的每个用户分配不同的权限。基本问题是如何在 ASP.NET MVC 中做这种事情。
I have site roles like Admin, User, and that is fine.
But let's say I have an legal application (or anything similar). I have an entity called Case. Now, I can have many cases and not all users should have access to any particular case. Let's say Fred and Tom should have access to Case1 but only Gina and Rebecca should have access to Case2?
Pretty simple, right? We have cases, and users can belong to a case. That's the first part. The second part is how to have "Case Roles" so Fred could be an "admin" of Case1 and be able to make major changes but maybe Tom is just a "user" of Case1 and can only do minor things and have read-only access, etc.
I know I will probably need to implement a custom attribute, etc but I can't find any examples on the Web of this particular kind of thing. But I imagine this must be very common in most business applications. (like Basecamp or Highrise, etc)
UPDATE Let me give a different example:
Take a project management software as a service application like Basecamp. A user can create a "project." Then that user can can invite other users to her "project." But, the creating user can assign different rights for each user to her project. The basic question is how to do this kind of thing in ASP.NET MVC.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我从你的问题中了解到的是，每个案例都是一个实体（数据库中的一行），并且您希望将不同案例（实体）的不同访问权限分配给不同的角色。在这种情况下，您可以拥有超级管理员角色，将案例的访问权限分配给其他角色。基于此信息，您可以编写自定义 atuhorize 属性并从数据库中获取超级管理员授予当前登录用户/角色的权限，并根据此条件做出决策。此外，创建案例的访问权限是通用的，因为创建案例之前并不存在，因此任何有权创建案例的人都可以创建任何案例（无论是 case1 还是 case49）。创建案例后，案例的创建者也可以设置该案例的权限。
what i understand from your question is that each case is an entity (a row in db) and you want to have different access rights for different cases (entities) be assigned to different roles. in this case you can have a super admin role that assigns access rights of cases to other roles. based on this information you can write custom atuhorize attribute and fetch permissions given by super admin to currently logged in user/role from database and make decisions on this criteria. Moreover, access rights on creating a case are generic because before creation it does not exist so any one who has right to create a case can create any case (be it case1 or case49). once a case is created permissions of this case can also be set by creator of the case.