如何根据我创建的自定义 UserRoles 表来保护某些操作不被使用
这是用户和用户角色的基本数据库结构。
我的客户希望能够查看某个角色并勾选一些框，“此角色可以执行 x 、y 和 z"。 X、Y 和 Z 是应用程序中的一些操作。
这不是一个新想法，而且我确信这种情况有一个经过验证的模式。与 Wordpress 的做法类似，它选择角色 Foo 可以执行的功能，并且用户属于该角色。
关于 MVC3 特定解决方案有什么建议吗？
This is the basic database structure for Users and UserRoles.
My client wants to be able to look at a Role and tick some boxes, "This role can do x, y and z". X, Y and Z being some actions in the application.
This isn't a new idea, and I'm sure there is a proven pattern for this situation. Similar to what Wordpress does, it selects functions a role Foo can perform, and a User belongs to that Role.
Any suggestions on an MVC3 specific solution?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
内置属性
[Authorize]可让您限制某些操作，以便只能由某些角色执行。对于您想要做的事情，我建议将“功能 X、Y 和 Z”视为角色，并将当前拥有的角色视为“用户组”或其他内容。因此，您的客户将能够为某些“角色”分配不同的“用户组”访问权限。
这样您就可以利用内置的成员资格/角色/授权内容。您需要做的就是实现您自己的 MembershipProvider 和 RoleProvider。
您的角色提供者实现
string[] GetRolesForUser(string username)需要进行数据库查找以查看它们所在的“用户组”，从而了解哪个“角色” '他们有权访问。如果这样做，您可以通过
[Authorize]属性轻松限制对不同功能的访问，并使用标准会员资格来处理登录过程。如果您的客户坚持将它们称为“角色”和“功能”而不是“用户组”和“角色” - 您无需告诉他这并不是您实现的方式:)
编辑
或者，您可以创建自己的授权属性，只需从
AuthorizeAttribute派生，并覆盖AuthorizeCore( HttpContextBase httpContext)返回 true 或 false如果用户处于允许的角色中，则执行功能“X”The built in Attribute
[Authorize]lets you restrict certain actions so that can be only performed by certain roles.For what you are trying to, I'd suggest that treat 'Functions X,Y and Z' as the roles, and that you treat what you currently have as roles as 'user groups' or something. So, your client then would be able to assign different 'User Groups' access to certain 'Roles'.
This way you could make use of the built in membership/role/authorization stuff. all you'd need to do was implement your own MembershipProvider and RoleProvider.
Your role providers implementation of
string[] GetRolesForUser(string username)would need to do a database look up to see what 'User group(s)' they are in, and therefore which 'Role(s)' they have access to.If you do that, you can easily restrict access to the different functions via the
[Authorize]attribute, and use the standard membership stuff for handling the login process.If your client insists on calling them 'Roles' and 'Functions' rather than 'User Groups' and 'Roles' - you don't need to tell him that this is not quite how you've implemented it :)
Edit
Alternatively, you can create your own Authorization attibute, just derive from
AuthorizeAttribute, and overrideAuthorizeCore( HttpContextBase httpContext)return true or false if the user is in a role permitted do do function 'X'