To design a security model is not a simple task itself, and without detailed knowledge of the domain, you're trying to secure it's close to impossible. Having said that any advice you can get here will be as general your question is.
1) In most applications the User -> Roles is enough. In more complex ones the User -> Roles -> Permissions could be used, but it all depends on how you'll define the scope of each. Often fine-grained roles and assigning a couple of them to the user is just what you'll need. I'd say putting another level be adding Groups in the middle is a bit too much. Imagine it as a file system - flat-file systems exist and are way less complicated as it may seem. Take your time while deciding this as this is one of the most important decisions and will have many implications that are not always easy to predict.
2) The authentication and remember-me mechanisms are already implemented in Spring Security - all you need to do is choose the implementation that best suits you and configure it using the security namespace support. Do take a look at Petclinic example app, if you haven't already.
3) If you decide on using permissions, you should always check for permissions. Keep the gain level you chose. Be consistent. Always.
4) Depending on the view technology you use, the JSP taglib may come in handy (as mentioned by Ralph). There is a non-such thing for JSF - but it's relatively simple to write something similar.
5) As Ralph said, if you hide something it doesn't mean it doesn't exist any more - it still can be called by an unprivileged user.
3) Depends on your implementation of Role - Permission assignment
2) Authentication and remember me is independent of using groups or not.
1) Depends on your needs. Groups make it more difficult, so I would start with User-Role-Permission and would add groups late when I really need it. -- Spring comes with an out of the box solution to assign Users to Privileges. Adding Roles is easy. But if you start with Groups you have to implement it by your own.
发布评论
评论（3）
设计安全模型本身并不是一项简单的任务，如果没有该领域的详细知识，您试图确保它的安全几乎是不可能的。话虽如此，您在这里可以获得的任何建议都将与您的问题一样普遍。
1) 在大多数应用程序中，
User ->角色就足够了。在更复杂的情况下，User ->角色 ->可以使用权限，但这完全取决于您如何定义每个权限的范围。通常，您需要细粒度的角色并将其中的几个角色分配给用户。我想说，在中间添加Groups来设置另一个级别有点太多了。将其想象为一个文件系统 - 平面文件系统是存在的，并且不像看起来那样复杂。请花点时间做出决定，因为这是最重要的决定之一，并且会产生许多并不总是容易预测的影响。2) 身份验证和记住我机制已经在 Spring Security 中实现 - 您所需要做的就是选择最适合您的实现并使用安全命名空间支持对其进行配置。如果您还没有看过 Petclinic 示例应用程序，请务必查看一下。
3) 如果您决定使用权限，您应该始终检查权限。保持您选择的增益水平。保持一致。总是。
4) 根据您使用的视图技术， JSP taglib 可能会派上用场（正如 Ralph 提到的）。 JSF 没有这样的东西 - 但编写类似的东西相对简单。
5) 正如拉尔夫所说，如果你隐藏了某些东西，并不意味着它不再存在——它仍然可以被非特权用户调用。
To design a security model is not a simple task itself, and without detailed knowledge of the domain, you're trying to secure it's close to impossible. Having said that any advice you can get here will be as general your question is.
1) In most applications the
User -> Rolesis enough. In more complex ones theUser -> Roles -> Permissionscould be used, but it all depends on how you'll define the scope of each. Often fine-grained roles and assigning a couple of them to the user is just what you'll need. I'd say putting another level be addingGroupsin the middle is a bit too much. Imagine it as a file system - flat-file systems exist and are way less complicated as it may seem. Take your time while deciding this as this is one of the most important decisions and will have many implications that are not always easy to predict.2) The authentication and remember-me mechanisms are already implemented in Spring Security - all you need to do is choose the implementation that best suits you and configure it using the security namespace support. Do take a look at Petclinic example app, if you haven't already.
3) If you decide on using permissions, you should always check for permissions. Keep the gain level you chose. Be consistent. Always.
4) Depending on the view technology you use, the JSP taglib may come in handy (as mentioned by Ralph). There is a non-such thing for JSF - but it's relatively simple to write something similar.
5) As Ralph said, if you hide something it doesn't mean it doesn't exist any more - it still can be called by an unprivileged user.
Spring Security 4-SNAPSHOT
权限组
http://docs.spring.io/autorepo/docs/spring-security/4.0.0.CI-SNAPSHOT/reference/htmlsingle/#authority-groups
另一种方法就是将权力机构分组并分配
给用户分组。
Spring Security 4-SNAPSHOT
Authority Groups
http://docs.spring.io/autorepo/docs/spring-security/4.0.0.CI-SNAPSHOT/reference/htmlsingle/#authority-groups
An alternative approach is to partition the authorities into groups and assign
groups to the user.
5) 即使您在 GUI 中隐藏了某些功能，恶意用户也可能会发送伪造的 HTTP 请求来调用您的功能。
4）对于JSP，有 spring security 标签库，也许 JSF 有类似的东西
3) 取决于您的角色 - 权限分配的实现
2) 身份验证和记住我与是否使用组无关。
1）取决于您的需求。组使它变得更加困难，所以我会从用户角色权限开始，并在我真正需要时添加组。 -- Spring 提供了一个开箱即用的解决方案来为用户分配权限。添加角色很容易。但如果您从 Groups 开始，您必须自己实现它。
我强烈建议您阅读 Spring-Security-Docs。
您可以按照 spring security 推荐的方式进行操作：“获取的建议步骤从 Spring Security 开始”或者您阅读了（非常好的）书“Spring Security 3”（由该框架的一些作者编写）。
如果您遵循本教程，您将找到如何进行简单的登录并记住我。
对于不同的角色和权限，您有两种选择。
5) Even if you hide some funсtion in the GUI, a malignant user could send a faked HTTP request that invokes your function.
4) For JSP there is the spring security tag lib, maybe there is something similar for JSF
3) Depends on your implementation of Role - Permission assignment
2) Authentication and remember me is independent of using groups or not.
1) Depends on your needs. Groups make it more difficult, so I would start with User-Role-Permission and would add groups late when I really need it. -- Spring comes with an out of the box solution to assign Users to Privileges. Adding Roles is easy. But if you start with Groups you have to implement it by your own.
I strongly recommend reading the Spring-Security-Docs.
Either you do it in the by spring security recommended way: "Suggested Steps for Getting Started with Spring Security" or you read the (very good) book "Spring Security 3" (written by some of the authors of the framework).
If you follow the tutorial you will find how to do a simple login and remember me.
To differ roles and authorities you have two choices.