复杂的安全规则
我所承担的任务在安全领域似乎是一个挑战。问题是建立一个具有以下功能的网站：
- 复杂的 ACL 和查看权限。例如。客户的交易历史记录应仅显示在客户支持代理的门户中。
- 多品牌。例如。如果客户支持代理是 Microsoft，那么他们应该只能访问该用户子集，并使网站的外观与他们的品牌相匹配。如果代理商是苹果公司，那么对其客户和品牌也采取同样的做法。
第 1 项是标准安全性。第二项（多品牌）似乎让事情变得过于复杂。
为了满足上述要求，似乎每个门户和访问请求都需要考虑以下因素：正在查看的品牌、用户角色、对象及其对给定品牌的成员资格。
我该如何解决上述问题？有没有关于如何构建安全的多品牌网站的文献？
I have been tasked with something that seems a challenge in the security world. The problem is to build a website that has:
- Complex ACLs and view permissions. eg. A customer's transaction history should only be displayed in a portal for the customer support agents.
- Multi-branded. eg. If the customer support agent is Microsoft then they should have access only to that subset of users and to have the site look'n'feel match their brand. If the agent is Apple then do likewise with their customers and brand.
Item #1 is standard security. Item #2 (multi-branding) seems to overcomplicate things.
To meet the above requirements it seems that each portal and access request will need to take into account things such as: brand being viewed, user roles, objects and their membership to a given brand.
How do I go about tackling the above? Is there any literature on how to build a secure, multi-branded site?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论