ASP.NET 权限框架？
问题
ASP.NET 没有将权限与角色关联的概念。
我的应用程序
当前的 Web 应用程序正在使用自定义用户成员资格和角色提供程序。该应用有 4 个角色：超级用户、管理员、校长和教师。当用户登录时，他们会被重定向到相应的 UI。例如，管理员被重定向到管理界面，教师被重定向到教师界面。每个界面都有自己的母版页和aspx页面。新的要求是教师不再被允许查看特定信息或执行特定功能。信息可以是 gridview 控件中的一个字段或一行，它也可以是功能性的（例如，无法单击链接来打开弹出窗口，但仍然能够看到链接的文本）。其他角色也有特定的“许可”要求，但与教师完全不同。
建议的解决方案
创建一个数据库表来集中权限到角色的映射，如下所示：
CREATE TABLE [dbo].[PermissionToRole](
[PermissionID] [int] IDENTITY(1,1) NOT NULL primary key,
[Role] int NOT NULL,
[Control] [varchar](50) NOT NULL,
[ControlType] [varchar](50) NOT NULL,
[Function] [varchar](50) NOT NULL,
[Read] [bit] NULL,
[Write] [bit] NULL,
[Execute] [bit] NULL,
[Delete] [bit] NULL
)
使用上面的链接示例，我们会得到类似：“teacher”， "labelName", "asp:label", "click", 1, 0, 0, 0 （可以读取链接，但 不是“执行”点击）
该计划是能够做一些事情：
- 使用权限将多个 aspx 和逻辑合并到单个页面 (aspx) 中。每次需要新角色时减少维护。
- 在所有级别（选项卡 -> 控制）控制角色（又名组）的权限。例如，使用此表来控制每个级别（选项卡、页面、控件）的控件的可见性。以及单独的功能（例如单击链接控件）
- 控制将哪些数据返回到 UI 以及允许哪些 CRUD 操作。
是否有 ASP.NET 框架可以做到这一点？ 我很确定内容管理系统 (CMS) 可以做到这一点，但此应用程序不会使用 CMS :)。我真的想避免重新发明轮子。
谢谢！
Problem
ASP.NET has no concept of associating permissions to roles.
My app
Current web application is using custom user membership and role providers. The app has 4 roles: superuser, admin, principal, and teacher. When the user logs in, they are redirected to their appropriate UI. For example, admins are redirected to admin interface, teachers are redirected to teacher interface. Each interface has its own master page and aspx pages. A new requirement is that teachers are no longer allowed to view specific information or do specific functions. Information could be a field or a row in a gridview control, it could be functional as well (e.g. not able to click on a link to open a popup window, but still be able to see the link's text). Other roles also have need of specific "permission" requirements, but completely different than the teachers ones.
Proposed Solution
Create a database table to centralize mapping of permissionsToRoles like so:
CREATE TABLE [dbo].[PermissionToRole](
[PermissionID] [int] IDENTITY(1,1) NOT NULL primary key,
[Role] int NOT NULL,
[Control] [varchar](50) NOT NULL,
[ControlType] [varchar](50) NOT NULL,
[Function] [varchar](50) NOT NULL,
[Read] [bit] NULL,
[Write] [bit] NULL,
[Execute] [bit] NULL,
[Delete] [bit] NULL
)
Using the link example above we would get something like: "teacher",
"labelName", "asp:label", "click", 1, 0, 0, 0 (can read the link but
not "execute" the click)
The plan is to be able to do a few things:
- Use permissions to consolidate multiple aspx and logic into a single page (aspx). To reduce maintenance every time a new role is needed.
- Control at a all levels (tab -> control) a roles' aka groups' permissions. E.g. use this table to control visibility of controls at every level (tab, page, control). As well as individual functionality (e.g. click on a link control)
- Control what data is returned to the UI and what CRUD operations are allowed.
Are there frameworks out there for ASP.NET that can do this already? I'm pretty sure Content Management Systems (CMS) can do this, but this app will not use a CMS :). I really want to avoid reinventing the wheel.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
请参阅 AzMan。我有一种感觉，这就是你所寻求的。
使用 AzMan，您可以定义操作并检查用户是否有权在代码中执行操作。然后，您可以定义允许哪些角色执行哪些操作并将角色分配给用户 - 因为您检查的是操作而不是角色，如果您想引入新角色或在角色之间重新分配操作，则无需更改代码。
Look at AzMan. I have a feeling that it's what you seek.
With AzMan you define operations and check if user authorized to do an operation in code. You can then define which roles allowed to do which operations and assign roles to users -- because you're checking against operations, not roles, no code changes will be necessary if you want to introduce a new role or reassign operations between roles.
决定尝试 NetSqlAzMan 因为：
Decided on trying NetSqlAzMan because:
事实上，ASP.net 成员资格控制 应该能够做到你想要什么。使用适当的模式设置数据库允许您使用大量的方法和对象来控制用户访问。就像 Luis 提到的那样，您可以访问某些角色的控制页面和文件夹，但如果您想根据用户的角色锁定单个功能，您可以使用
IsUserInRole()方法。如果您可以使用内置的、经过充分测试的流程。
In truth, the ASP.net membership controls ought to be able to do what you want. Setting up a database with the appropriate schema allows you to use a huge suite of methods and objects to control user access. Like Luis mentions, you can access control pages and folders to certain roles, but if you want to lock out individual functions based on a user's role, you can use the
IsUserInRole()method.There isn't a whole lot of point in reinventing the wheel if you can use a built-in, well-tested process.