Azure Active Directory的分层RBAC系统
我正在寻找一个用于Azure Active Directory帐户的分层RBAC系统。
使用层次RBAC系统，我想授权用户可以访问并扮演层次结构，例如：
- 客户1
- 角色：财务 - 用户g
- 购物痣A。
- 商店X
- 角色： admin - 用户u
- 角色：安全 - 用户U，用户V
- 角色：访问 - 用户U，用户K，用户L
- 角色：财务 - 用户L，用户n
- 购物y
- 角色： admin - 用户q
- ...
- 商店X
- 客户2
- ...
请注意，用户可能会在X和Y商店y处发挥不同的作用。
对这样的系统/库的任何指示？
I'm looking for a hierarchical RBAC system to be used with Azure Active Directory accounts.
With the hierarchical RBAC system I would like to authorize users to have access and be in roles in a hierarchical structure, e.g.:
- Customer 1
- role: finance - user G
- Shopping mole A
- Shop X
- role: admin - user U
- role: security - user U, user V
- role: access - user U, user K, user L
- role: finance - user L, user N
- Shop Y
- role: admin - user Q
- ...
- Shop X
- Customer 2
- ...
Note that a user could be in a different role for shop X and shop Y.
Any pointers to such a system/library?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
•您想在您的方案中使用层次RBAC权限用于Azure Active Directory帐户，可以通过利用身份和访问管理的托管身份功能来实现。
通过系统分配的托管身份，您可以为您要与分配给其的用户部署和管理的Azure资源的身份。同样，如果您为用户创建用户分配的托管身份，那么
可以分配各种级别的权限和特权，相对于您要部署和使用的Azure资源，相同的身份可以为特定管理组部署的资源具有不同的权限和角色，而分配给该用户的相同身份可以具有另一个AURE资源的不同权限和角色。•因此，对Azure AD ，没有像本地Active Directory 中设计的层次结构系统，但是Azure AD中的RBAC系统（如果最佳使用）使用非常强大且有用。就像当您说要同一用户在不同业务部门中执行角色时一样，您可以将分配的托管身份对良好的影响进行良好的影响，因为它将基于创建的和创建的用户利用不同的RBAC权限通过与之链接的Azure托管身份，从而成功地保持用户的原始身份谨慎并确保应用RBAC权限。
有关更多信息，您可以肯定地参考下面的文档链接： -
https://learn.microsoft.com/en-us/azure/active-directory/managed-indiesties-indiesities-ientities-ientities-azure-resources/overview
• The way you want to use the hierarchical RBAC permissions for the Azure Active Directory accounts in your scenario can be achieved by leveraging the managed identity feature of Identity and Access Management.
Through the system assigned managed identity, you can create an identity for the Azure resource that you want to deploy and manage with the user that is assigned to it.Similarly, if you create a user assigned managed identity for a user, then that
user can be assigned varied levels of permissions and privileges relative to the Azure resources that you want to deploy and use such that the same identity can have different permissions and roles for a resource deployed for a particular management group while that same identity assigned to that user can have different permissions and roles for another Aure resource.• Thus, with regards to Azure AD, there is no such hierarchical system designed as in on-premises Active Directory but the RBAC system in Azure AD is quite robust and useful if used on an optimum basis. As when you said that you want the same user to perform roles in different business units, you can use the user assigned managed identity to a good affect as it will leverage the different RBAC permissions for the same user based on a created and managed identity by Azure that is linked to it thus thereby successfully keeping the user’s original identity discreet and ensuring the RBAC permissions are applied.
For more information, you can surely refer to the documentation link below: -
https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview