ASP.NET MVC 3 中的行级权限或 facebook 风格的隐私？
我正在开发一个需要自定义精细安全/隐私设置的项目。基本上我需要能够根据执行查询的用户来限制对数据的访问。很容易，对吧？不过，这里有一些问题......
- 用户必须存储在用户表中。此应用程序不可接受创建 Windows 用户帐户、SQL Server 用户或 SQL Server 角色。
- 安全标准必须由任意数量的来源来定义，即用户的位置、薪资等级、专业等。
现在我们通过生成 SQL“where”子句并将其附加到每个查询的末尾来实现这一点在它被执行之前。这限制了我们利用实体框架等新技术，并且还带来了其他限制和性能问题。
任何帮助或想法将不胜感激。如果需要额外说明，请告诉我。
谢谢！贾森
I am working on a project that requires custom granular security/privacy settings. Basically I need to be able to restrict access to data based on the user executing the query. Easy enough, right? Here a couple of gotchyas though..
- The users must be stored in a users table. Creating Windows user accounts, SQL server users or SQL server roles is unacceptable for this application.
- The security criteria has to be defined by any number of sources, i.e. a user's location, pay grade, specialty, etc..
Right now we're implementing this by generating a SQL "where" clause and appending it to the end of every query before it's executed. This restricts us from being able to leverage newer technologies such as Entity Framework and also carries with it its own other limitations and performance problems.
Any help or ideas would be greatly appreciated. Please let me know if additional clarification is needed.
Thanks! Jason
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您仍然可以使用实体框架。使用 EF 有多种方法可以实现此目的：
创建一个注入
WHERE子句的自定义包装提供程序，例如 this。仅公开包含
Where()之前的数据的IQueryable（但要注意关系）如果当前用户无权访问实体构造函数（可能不是一个好主意）
You can still use Entity Framework. There are a couple of ways to do this with EF:
Create a custom wrapping provider that injects
WHEREclauses, like this.Only expose
IQueryables that contain pre-Where()'d data (but beware of relations)Throw an exception in the entity ctor if the current user doesn't have access to it (may not be a good idea)