“对象”在 RBAC 系统中
我正在研究工作中 Web 应用程序的基于角色的身份验证。我们使用 Coldfusion，它似乎没有制作任何好的 rbac 库，因此我们可能必须从头开始制作一个。
查看示例数据模型，对象与权限相关联。
http://www.mind-it.info/ 2010/01/09/nist-rbac-data-model/
看起来对象和权限之间是一对多的关系，这是有道理的。
但是，我想知道这些“对象”应该是抽象的还是具体的？
我们的系统将有一些有限类型的对象；举例来说，让我们说“新闻”、“事件”和“专辑”。权限和角色很可能归因于这些类型，因为任何这些类型的所有对象实例都需要不同角色的相同权限和可访问性。
在我查看的示例中，在我看来，对象的每个实例都附加了权限。如果是这种情况，我会在这种类型的系统中看到很多开销......
所以，我想知道这些“对象”实际上是否是与角色关联的抽象对象类型，或者如果这些“对象”是实际的对象实例本身吗？ （或者，如果 rbac 模型允许任一实现......）
谢谢！
am looking at role-based authentication for the web app at my work. we use coldfusion, which does not seem to have any good rbac libraries made, so we might have to make one from scratch.
looking at a sample data model, objects are tied to permissions.
http://www.mind-it.info/2010/01/09/nist-rbac-data-model/
it looks like a one to many relationship between objects and permissions, which makes sense.
however, i am wondering if these "objects" should be abstract or concrete?
our system will have a few limited types of objects; for sake of example, let us say "news", "events", and "albums". the permissions and roles will most likely be attributed to these types, since all object instances of any of these types will require the same permissions and accessibility for the different roles.
in the example i looked it, it seemed to me that each instance of an object was attached to permissions. if this were the case, i see a lot of overhead in this type of system...
so, i was wondering whether or not these "objects" are in fact the abstract object types that are associated with a role, or if these "objects" are the actual object instances themselves? (or, if the rbac model allows for either implementation...)
thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您绝对应该将权限与对象绑定。是的，开发它时会产生一些开销，但这是迄今为止最好的情况。
想想看，当您开发“添加新闻项”功能时，您会创建一个名为“addNewsItem”之类的权限。然后，您只需将该权限与您希望拥有该能力的角色联系起来即可。
该系统的优点在于，一旦您对与对象（如添加项目）相关的权限进行了编码，即使您的用户或角色发生变化，您也无需更改它。 “添加新闻项”始终需要“addNewsItem”权限。这永远不会改变。
例如，如果您用角色包装对象，并且决定添加新角色 - 您将进入并更改代码以允许该角色任何权限。恶心。
它实际上很容易实现。这是我写的一篇关于实现的一些基础知识的文章：
ColdFusion：基于应用程序选项关于角色？
You should definitely tie permissions to objects. Yes, there is some overhead while developing it, but it is by far the best case.
Think about it, while you're developing lets say the "Add news item" functionality, you create a permission called something like "addNewsItem". Then you simply tie that permission to the roles that you want to have that ability.
The beauty of this system is that once you code your permissions tied to objects (like the add item), you never have to change it if your users or roles ever change. The "Add news item" will always need the "addNewsItem" permission. That never changes.
If you instead wrap your objects with roles for example, and you decide to add a new role - you're going to be going in and changing code to allow that role any permission. Yuck.
Its actually quite easy to implement. Here's a post I did with some basics on implementation:
ColdFusion: Application Options Based on Role?