设计一个复杂的访问/权限系统，我应该采取什么方法
我现在使用 PHP+MySQL，但实际上可以采用任何工具。
我有一个大约有 50000 个用户的系统，这些用户被排列成组，排列成部门，排列成组织。
我的系统内容包中有。每个包都有特定的权限。即每个包要么是
- 公共的（世界），
- 要么是联盟的（全部注册到我的系统）
- 私有的（可以由单个用户+组+部门+组织的任意组合访问）
为了让事情变得更困难，每个内容可能都有一个先决内容，意味着您在学习内容 A 之前不能学习内容 B（大学课程...）。
我想知道如何管理它，现在一切都在 MySQL 中并且工作正常，只是每次我创建具有先决条件的内容时，我必须能够仅选择那些具有更宽松访问权限的内容片段作为先决条件，这意味着系统中的每个部分都需要进行大量计算（我有几千个）。
现在，假设我有内容 c，它依赖于 B，而 B 又依赖于 A...
我向每个用户展示的目录是什么？想象一下当用户搜索整个系统时我必须对每个内容片段进行的计算。
有任何方向/建议/已知系统已经做到了这一点吗？
I am using PHP+MySQL right now, but really can adopt any tool out there.
I have a system with about 50000 users which are arranged into groups, which are arranged into departments which are arranged into organizations.
I have in my system content packages. Each package has a specific permission. i.e. each package is either
- public (world),
- consortium (all registered to my system)
- private (can be accessed by any combinations of single users + group + department + organization)
To make things harder, Each content might have a pre-requisite content, means you can't take content B before you took content A (courses in a university...).
I am wondering how to manage it, right now every thing is in MySQL and works fine, just that each time I create a content with pre-requisite I must be able to choose as pre-requisite only those content pieces with more permissive access, which means a lot of computations for each piece I have in the system (I have a few thousands).
Now, Imagine I have content c which depends on B which depends on A...
And what is the catalog that I show to each user? Imaging the calculation I have to do for each content piece when the user searches the entire system.
Any direction/suggestion/known systems that do that already?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我意识到这个问题已经持续了两年多了，现在您可能已经解决了您的问题。不过，这里有一些提示可以帮助您解决所面临的问题。
您需要外部化您的授权逻辑和业务逻辑。这意味着您想要研究业务规则引擎和授权规则引擎。
该领域的标准是 BPEL（针对业务流程）和 XACML（针对授权）。
您可以使用 XACML 来确定谁可以查看/编辑/获取某些内容。您可以使用 BPEL（或 BPM 语言）来确定参加一门课程的规则，然后才能参加另一门课程。
I realize this question is over 2 years and that by now you have likely solved your issue. Still, here are some pointers to help solve the problem you were faced with.
You need to externalize your authorization logic and your business logic. This means you want to look into business rules engines and authorization rules engines.
The standards in that space are BPEL (for business processes) and XACML (for authorization).
You'd use XACML to determine who can view / edit / take certain content. You'd use BPEL (or BPM languages) to determine the rules about taking a course before you can take another.