LDAP 中基于角色的安全实现
我正在研究 LDAP 和 Java 中基于角色的安全实现。具体来说，我需要在 LDAP 中表示以下对象：
- 用户
- 公司用户组 - HR、财务等
- 权限 - DOCUMENT_READ、DOCUMENT_MODIFY 等
- 角色 - ADMIN、GUEST 等
角色基本上是权限组，它们可以分配给一个用户或一组用户。
我正在考虑在 LDAP 中将它们表示如下：
- 用户 - 具有 userPassword 属性的 Person 和 uidObject 类。
- 用户组 - OrganizationUnit 类，用户位于该类下 位于。
- 角色 - groupOfNames 对象类。
- 权限 - 不确定这个，也许还有 groupOfNames 班级。
其想法是让用户或组快速访问该用户或组所具有的角色列表。我知道我可以将用户和组放入角色的“成员”属性中，但随后我必须扫描所有角色以查找列出了该用户的角色。有没有办法在 Person 对象中拥有类似“member”属性的东西？
一般来说，有人知道 LDAP 中基于角色的安全实现吗？我找不到关于这个主题的好的文档或教程。我目前使用 ApacheDS 作为 LDAP 服务器，但我愿意接受建议。
I'm working on role-based security implementation in LDAP and Java. Specifically, I have the following objects that I need to represent in LDAP:
- Users
- Corporate groups of users - HR, Finance etc.
- Permissions - DOCUMENT_READ, DOCUMENT_MODIFY etc.
- Roles - ADMIN, GUEST etc.
Roles are basically groups of permissions, and they can be assigned to a user or to a group of users.
I was thinking of representing them in LDAP as folows:
- Users - Person and uidObject classes with userPassword attribute.
- Groups of users - organizationalUnit class, under which the users are
located. - Roles - groupOfNames object class.
- Permissions - not sure about this one, perhaps also groupOfNames
class.
The idea is to have a quick access from a user or a group to a list of roles that this user or group have. I know that I can put users and groups in a "member" attributes of a role, but then I will have to scan all roles to find which ones have this user listed. Is there a way to have something like the "member" attribute in a Person object?
Generally, does anyone know of a good role-based security implementation in LDAP? I could not find good documentation or tutorials on this subject. I'm using ApacheDS as an LDAP server currently, but I'm open to suggestions.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
用户：inetOrgPerson
集合：organizationalUnit，但请注意尝试在 LDAP 目录中复制组织结构：这通常是一个错误，因为组织会发生变化并且用户会在组织中移动。您应该考虑使用 ou 属性。
角色：组织角色。我将角色组用作 groupOfUniqueNames，但这是一个错误，我应该继续使用organizationalRole，以便角色只是递归的。
权限：这实际上只是一个角色，或者说是角色的一个属性。如果您使用 CMA，它们将在 web.xml 中定义，而不是在 LDAP 中。
正如我所说，不要尝试让您的 LDAP 树反映您的组织。使其反映自己的组织。我在必要时使用多值属性。我主要将organizationalUnit 用于LDAP 本身内的层，或者是我违反上述规则的地方；-)
OpenLDAP 有一个引用完整性覆盖层，可以为您保留很多信息。
Matt Butcher 的《掌握 OpenLDAP》中对 LDAP 结构有一些非常好的提示，Howes 的《理解和部署 LDAP 目录服务》中提供了更高层次的视图。等人。
Users: inetOrgPerson
Collections: organizationalUnit, but beware of trying to replicate your organizational structure in your LDAP directory: this is usually a mistake, as organizations change and users move around the organization. You should consider using the ou attribute.
Roles: organizationalRole. I used groups of roles as groupOfUniqueNames, but that was a mistake, I should have kept using organizationalRole so that roles are simply recursive.
Permission: this is just a role really, or an attribute of a role. If you use CMA they are defined in web.xml, not LDAP.
As I said, don't try to make your LDAP tree mirror your organization. Make it mirror its own organization. I use multiple-valued attributes wherever necessary. I use organizationalUnit mainly for layers within LDAP itself, or where I have broken my rules above ;-)
OpenLDAP has a referential integrity overlay which can keep a lot of this straight for you.
There are some very good hints on LDAP structure in Mastering OpenLDAP by Matt Butcher, and a higher level view of it all in Understanding and Deploying LDAP Directory Services by Howes et al.
另一种选择：查看基于属性的访问控制（abac）。 ABAC 是 RBAC 的演变。它使用属性（关于用户、资源、上下文的标签）和策略来确定允许什么和不允许什么。
示例：如果采购订单金额<=用户的审批限制，则部门==销售中具有角色==经理的用户可以对类型==采购订单的文档执行操作==编辑。
您可以在 NIST 网站 上了解有关 ABAC 的更多信息。
One more option: check out attribute-based access control (abac). ABAC is an evolution of RBAC. It uses attributes (which are labels about the user, the resource, the context) and policies to determine what is allowed and what isn't.
Example: A user with the role==manager in the department==sales can do the action==edit on a document of type==purchase order if the PO's amount<=the user's approval limit.
You can read more on ABAC at the NIST website.
看看堡垒。它符合 ANSI RBAC INCITS 359 并基于 LDAP 构建。源代码是开源的，您可以从此处下载包含 OpenLDAP 的预构建二进制文件：http://iamfortress.org/< /a>
Check out Fortress. It is ANSI RBAC INCITS 359 compliant and built on LDAP. The source code is open source and you can pull down pre-built binaries that include OpenLDAP from here: http://iamfortress.org/