根据用户所属组限制 hibernate 查询数据
标准示例可能是您在同一托管实例上向多个公司提供服务，并希望员工只能看到同一公司其他员工的数据，而不是潜在竞争公司的数据。
我正在使用 JBossAS7 和 Hibernate 4.x。
我可以将公司信息从 UI 层向下推送，并对其进行（无状态）持久层过滤，但这对我来说似乎是一个坏主意，我宁愿在一个地方完成它更接近数据库。
我猜想必须有一个标准的、安全的解决方案，也许围绕安全域或休眠会话？想法？提前致谢。
The standard example is probably where you offer a service to multiple companies on the same hosted instance and want employees to be able to see data only from other employees of the same company, not of potentially competitive companies.
I'm using JBossAS7 with Hibernate 4.x.
I could push the company information down from the UI layer and have the (stateless) persistence layer filter on that, but it seems like a bad idea to me, I'd rather have it done in one place closer to the database.
I'm guessing there must be a standard, secure solution for this, maybe around security domains or hibernate sessions? Thoughts? Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您似乎正在构建一个“多租户应用程序”。目前 Hibernate 对多租户的支持相当有限，功能请求 5697 已被最近完成，在 4.0.0.Alpha2 中。请注意，此功能请求并未解决在实体中添加租户鉴别器列的问题，根据 JIRA 中的讨论，该功能将在 4.0.0.Alpha3 或 4.1.0（通过 JIRA）。目前，您可以将与不同租户相关的数据存储在不同的数据库或模式中。
您还可以阅读这篇相关博客文章，了解有关在 Hibernate 中实现多租户的各种选项；与 HHH-5697 中所做的工作相比，这已经相当老了，并且没有讨论如何在实体模型中使用租户鉴别器列创建多租户应用程序。
You seem to be building a "multi-tenant application". Hibernate's support for multi-tenancy is quite restricted at the moment, with feature request 5697 having been recently completed, in 4.0.0.Alpha2. Note that this feature request does not address addition of tenant discriminator columns in the entities, which going by the discussion in JIRA, would arrive in 4.0.0.Alpha3 or 4.1.0 (going by JIRA). At the moment, you can store the data related to various tenants in different databases or schemas.
You can also read this related blog post, on various options regarding achieving multi-tenancy in Hibernate; this is quite old compared to the work done in HHH-5697, and does not discuss how one would create a multi-tenant application with tenant discriminator columns in the entity model.
我不确定任何标准，但在两个很重要的系统上工作过。这些过时的工具如 Hibernate 和我们对 J2EE 的使用。
在我工作过的所有系统中，我们都必须自己编写代码 - 使用公司作为请求中密钥的一部分。
一种可能性是为每个客户提供完全不同的“无论您的数据库如何称呼其分区”。 （如果您使用的是 Oracle，则为架构）。听起来更复杂，但它确实保证了公司之间的隔离，并且还允许对扩展或新建/删除公司进行一些管理。我记得在我以前的工作地点，如果有人提到将多个公司的数据保存在同一张表中，法律人员会感到紧张 - 这让他们很高兴。
您可以让应用程序服务器作为可以访问所有内容的受信任用户连接到数据库，或者确保在连接时传递最终用户的凭据。我听说过这个。从安全角度来看，这听起来不错，并且意味着在像 Oracle 这样的数据库中，正确的事情就会发生。我还没有看到它完成，并且想知道连接池如果有的话效果如何。
编辑：Vineet 上面的回答似乎很好地涵盖了它。这是我需要更多关注的领域。我们可能有太多遗留代码需要更改。
I'm not sure of any standard, but have worked on two systems where it was important. These pre-dated tools like Hibernate and our use of J2EE.
In all systems I've worked on we've had to code this ourselves - using company as part of our keys in requests.
One possibility is a whole different "whatever your database calls its partition" for each customer. (Schema if you're in Oracle). Sounds more complex but it does guarantee isolation between companies and it does also allow some management of scaling or new/delete company. In my previous place of work I remember legal types felt nervous if anyone mentioned keeping more than one company's data in the same table - so that kept them happy.
You could either have your app server connect to the database as a trusted user who can access all, or make sure you pass the end user's credentials down when you connect. I've heard of this. It sounds good from a security point of view and means in a database like Oracle the right thing will just happen. I've not seen it done and wonder how well connection pooling would work if at all.
Edit: Vineet's answer above seems to cover it well. It's an area I'll have to look at more. We've probably got too much legacy code here to change.