SharePoint 2010 授权问题
假设我在共享点站点中有 2 个页面。我们将它们称为页面 A 和 B。我们使用基于 Windows 的身份验证机制。假设我有 2 个已经通过身份验证的用户 X & Y. 页面 A 应该对 Active Directory 中某些属性设置为 1 的用户可见。页面 B 应该仅对未将此属性设置为 1 的用户可见。我们将此属性称为 SpecialUser。如果给定用户的 SpecialUser 为 1，则用户应该只能看到页面 A 而不能看到页面 B。如果 SpecialUser 有任何其他值，则用户应该只能看到页面 B 而不能看到页面 A。
在这种情况下，用户 X 的 SpecialUser 属性设置为 1，而用户 Y 则没有。因此，用户 X 只能看到页面 A，而用户 Y 只能看到页面 B。Active
Directory 中不存在仅包含 SpecialUser 属性值设置为 1 的用户的组。我们不想创建 sharepoint 组并添加这些用户手动也可以。
考虑到这些限制，我们如何才能获得授权呢？我认为可能需要自定义编码。如果需要自定义编码，我该如何去做。如果没有，解决办法是什么？
Let’s say I have 2 pages in a sharepoint site. Let’s call them page A and B. We are using windows based authentication mechanism. Let’s say I have 2 already authenticated users X & Y. The page A should be visible to users who have certain attribute set to 1 in active directory. Page B should only be visible to those users that does not have this attribute set to 1. Let’s call this attribute SpecialUser. If SpecialUser is 1 for a given user, user should be able to see page A only and not be page B. If SpecialUser has any other value, user should be able to see page B only and not be page A.
In this case, user X has the attribute SpecialUser set to 1 and user Y does not. So user X should only see page A while user Y should only see page B.
There is no group in active directory that includes only users that have SpecialUser attribute value set to 1. We don’t want to create sharepoint group and add these users manually either.
Given these constraints, how can we achieve this authorization? I am thinking there may be a need for custom coding. If custom coding is required, how do I go about it. If not, what is the solution?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您的 Web 应用程序可以设置为使用基于声明的模式而不是经典模式，那么您应该无需自定义编码即可实现此目的，因为在页面上设置权限时可以将 Active Directory 属性用作声明。
否则需要自定义编码。您可以创建放置在页面上的自定义 Web 部件，该部件可以重定向用户或调用 SPUtility.HandleAccessDenied(new UnauthorizedAccessException()) 用于无效用户。为了安全地修剪页面（使它们不可见），您在显示页面的任何菜单或 Web 部件中都需要类似的逻辑。
如果 Active Directory 属性是 SharePoint 用户配置文件的一部分，则可以使用 UserProfile 类。否则，您可以使用 System.DirectoryServices.AccountManagement 检索属性的值。
If your Web Application can be setup to use Claims Based Mode instead of Classic Mode, you should be able to achieve this without custom coding, since an Active Directory attribute can be used as a claim when setting permissions on the page.
Otherwise custom coding would be required. You can create a custom web part that you place on the page, which can either redirect the user or call SPUtility.HandleAccessDenied(new UnauthorizedAccessException()) for invalid users. To security trim the pages (make them invisible), you would need similar logic in any menus or web parts that display the pages.
If the Active Directory attribute is part of the SharePoint User Profile, you can use the UserProfile class. Otherwise, you can use System.DirectoryServices.AccountManagement to retrieve the value of the attribute.
我认为最简单的方法可能是坚持使用活动目录。 Sharepoint 身份验证可能有点变化无常。我可能会突然建议创建一个活动目录组来保存这些用户的列表。您可以让服务经常运行（每天一次？每小时一次？取决于您愿意使用过时的身份验证多长时间），而不是手动更新它，并检查活动目录中的用户列表是否有此标志。然后，该服务将更新您用于身份验证的组。
可能有一种方法可以在 Sharepoint 开发的范围内更优雅地完成此操作，但我还没有听说过类似的方法。
I think that the easiest thing to do might be to stick with the active directory side. Sharepoint authentication can be a bit fickle. Off the top of my head I would probably suggest creating an active directory group that's meant to hold a list of these users. Rather than updating it manually you could have a service to run every so often (once a day? once an hour? depends on how long you're willing to have stale authentication) and check the user lists in active directory for this flag. The service would then update the group you're using for authentication.
There might be a way to do this more gracefully within the walls of Sharepoint development, but I've not heard of anything like it.