�??xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/"><channel><title>&#x4E9A;&#x6D32;&#x7F8E;&#x5973;&#x5728;&#x7EBF;&#x89C6;&#x9891;&#x2C;&#x32;&#x32;&#x32;&#x38;&#x38;&#x8272;&#x89C6;&#x9891;&#x5728;&#x7EBF;&#x89C2;&#x770B;&#x2C;&#x7CBE;&#x54C1;&#x56FD;&#x4EA7;&#x39;&#x31;&#x4E45;&#x4E45;&#x4E45;&#x4E45;&#x4E45;&#x6D6A;&#x6F6E;&#x871C;&#x6708;</title><link>http://www.aygfsteel.com/caizh2009/category/39578.html</link><description>与大家共同成�?/description><language>zh-cn</language><lastBuildDate>Thu, 14 May 2009 11:44:15 GMT</lastBuildDate><pubDate>Thu, 14 May 2009 11:44:15 GMT</pubDate><ttl>60</ttl><item><title>��Z��rbac 的权限设�?/title><link>http://www.aygfsteel.com/caizh2009/articles/270622.html</link><dc:creator>���菜毛毛</dc:creator><author>���菜毛毛</author><pubDate>Thu, 14 May 2009 07:47:00 GMT</pubDate><guid>http://www.aygfsteel.com/caizh2009/articles/270622.html</guid><wfw:comment>http://www.aygfsteel.com/caizh2009/comments/270622.html</wfw:comment><comments>http://www.aygfsteel.com/caizh2009/articles/270622.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/caizh2009/comments/commentRss/270622.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/caizh2009/services/trackbacks/270622.html</trackback:ping><description><![CDATA[<p style="margin: 0cm 0cm 0pt 21.25pt; text-indent: -21.25pt; line-height: 150%; text-align: left; tab-stops: list 21.25pt" align="left"><span style="font-size: 16pt; line-height: 150%; font-family: 宋体"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">��Z��<span>RBAC的权限设计模型：<span> </span></span></span></span>
<p style="margin: 0cm 0cm 0pt 21.25pt; text-indent: -21.25pt; line-height: 150%; text-align: left; tab-stops: list 21.25pt" align="left"><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">1<span style="font: 7pt 'Times New Roman'">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span></strong><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">RBAC</span></strong><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">介绍<span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt 35.45pt; line-height: 150%; text-align: left" align="left"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">RBAC</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">模型作�ؓ目前最为广泛接受的权限模型�?span> </span></span>
<p style="margin: 0cm 0cm 0pt 35.45pt; line-height: 150%; text-align: left" align="left"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">NIST</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">�Q�The National Institute of Standards and Technology�Q�美国国家标准与<a onclick="javascript:tagshow(event, '%BC%BC%CA%F5');" href="javascript:;" target="_self"><u><strong>技�?/strong></u></a>研究院）标准RBAC模型�?个部件模型组成，�q?个部件模型分别是基本模型RBAC0�Q�Core RBAC�Q�、角色分�U�模型RBAC1�Q�Hierarchal RBAC�Q�、角色限制模型RBAC2�Q�Constraint RBAC�Q�和�l�一模型RBAC3�Q�Combines RBAC�Q?sup>[1]</sup>。RBAC0模型如图1所�C��?span> </span></span>
<p style="margin: 0cm 0cm 0pt; text-align: center" align="center"><span style="font-size: 10pt; font-family: 黑体"><shapetype id="_x0000_t75" stroked="f" filled="f" path="m@4@5l@4@11@9@11@9@5xe" o:preferrelative="t" o:spt="75" coordsize="21600,21600">
</formulas>
</shapetype><shape id="_x0000_i1025" style="width: 361.5pt; height: 108pt" alt="RBAC 0模型.JPG" type="#_x0000_t75"><imagedata o:href="/images/blogjava_net/bluedavy/RBAC%200%E6%A8%A1%E5%9E%8B.JPG" src="file:///D:"  Temp?msohtml1?01?clip_image001.jpg?><img title="点击囄���可在新窗口打开" style="cursor: pointer" height="144" alt="clip_image001.jpg" src="http://www.aygfsteel.com/images/blogjava_net/anwenhao/clip_image001.jpg" width="482" border="0" /></imagedata></shape><br />
</span><span style="font-size: 10pt; font-family: 黑体">图表</span><span style="font-size: 10pt; font-family: Arial">1 RBAC 0</span><span style="font-size: 10pt; font-family: 黑体">模型</span><font size="3"><font face="宋体, MS Song"><span style="font-size: 12pt; font-family: 宋体"> </span></font></font>
<p style="margin: 0cm 0cm 0pt 48pt; text-indent: -21pt; line-height: 150%; text-align: left" align="left"><span style="font-size: 12pt; line-height: 150%; font-family: Wingdings">l</span><span style="font-size: 7pt; line-height: 150%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">RBAC0</span></strong><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">定义了能构成一个RBAC控制�pȝ��的最���的元素集合</span></strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt 48pt; line-height: 150%; text-align: left" align="left"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">在RBAC之中,包含用户users(USERS)、角色roles(ROLES)、目标objects(OBS)、操作operations(OPS)、许可权permissions(PRMS)五个基本数据元素�Q�权限被赋予角色,而不是用��P��当一个角色被指定�l�一个用��h���Q�此用户���拥有了该角色所包含的权限。会话sessions是用户与�Ȁ�zȝ��角色集合之间的映���。RBAC0与传�l�访问控制的差别在于增加一层间接性带来了灉|��性，RBAC1、RBAC2、RBAC3都是先后在RBAC0上的扩展�?span> </span></span>
<p style="margin: 0cm 0cm 0pt"><span style="font-size: 12pt; font-family: Wingdings">l</span><span style="font-size: 7pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><strong><span style="font-size: 12pt; font-family: 宋体">RBAC1</span></strong><strong><span style="font-size: 12pt; font-family: 宋体">引入角色间的�l�承关系</span></strong><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt 48pt; line-height: 150%; text-align: left" align="left"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">角色间的�l�承关系可分��Z��般��承关�p�d��受限�l�承关系。一般��承关�p�M��要求角色�l�承关系是一个绝对偏序关�p�，允许角色间的多���ѝ��而受限��承关�p�d���q�一步要求角色��承关�p�L��一个树�l�构�?span> </span></span>
<p style="margin: 0cm 0cm 0pt"><span style="font-size: 12pt; font-family: Wingdings">l</span><span style="font-size: 7pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><strong><span style="font-size: 12pt; font-family: 宋体">RBAC2</span></strong><strong><span style="font-size: 12pt; font-family: 宋体">模型中添加了责�Q分离关系</span></strong><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt 48pt; line-height: 150%; text-align: left" align="left"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">RBAC2</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">的约束规定了权限被赋予角色时,或角色被赋予用户�?以及当用户在某一时刻�Ȁ�z�M��个角色时所应遵循的强制性规则。责��d�����d��括静态责��d�����d��动态责��d�����R��约束与用户-角色-权限关系一起决定了RBAC2模型中用��L��讉K��许可�?span> </span></span>
<p style="margin: 0cm 0cm 0pt"><span style="font-size: 12pt; font-family: Wingdings">l</span><span style="font-size: 7pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><strong><span style="font-size: 12pt; font-family: 宋体">RBAC3</span></strong><strong><span style="font-size: 12pt; font-family: 宋体">包含了RBAC1和RBAC2</span></strong><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">既提供了角色间的�l�承关系�Q�又提供了责��d�����d���p�R�?span> </span></span>
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">建立角色定义表。定出当前系�l�中角色�?span> </span></span>
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">因�ؓ有��承的问题�Q�所以角色体现出的是一个树形结构�?span> </span></span>
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体"><shape id="_x0000_i1026" style="width: 320.25pt; height: 4in" type="#_x0000_t75"><imagedata src="file:///D:" o:title=""  Temp?msohtml1?01?clip_image002.emz?><img title="点击囄���可在新窗口打开" style="cursor: pointer" height="407" alt="test.bmp" src="http://www.aygfsteel.com/images/blogjava_net/anwenhao/未命�?.bmp" width="603" border="0" /></imagedata></shape> </span>
<p style="margin: 0cm 0cm 0pt 21.25pt; text-indent: -21.25pt; line-height: 150%; text-align: left; tab-stops: list 21.25pt" align="left"><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">2<span style="font: 7pt 'Times New Roman'">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span></strong><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">权限设计�Q?span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">配置资源以及资源的操�?�Q?�q�里资源可以定义��Z��个通用的资源模型。提供通用的资源统一接口�?span> </span></span>
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt 26.95pt; text-indent: 21pt; line-height: 150%"><span style="font-family: 宋体"><a onclick="javascript:tagshow(event, '%CA%FD%BE%DD%BF%E2');" href="javascript:;" target="_self"><u><strong>数据�?/strong></u></a></span>ER<span style="font-family: 宋体">图：</span></p>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><shape id="_x0000_i1027" style="width: 414.75pt; height: 241.5pt" type="#_x0000_t75" o:ole=""><imagedata src="file:///D:" o:title=""  Temp?msohtml1?01?clip_image004.emz?><img title="点击囄���可在新窗口打开" style="cursor: pointer" height="322" alt="clip_image002.gif" src="http://www.aygfsteel.com/images/blogjava_net/anwenhao/clip_image002.gif" width="553" border="0" /></imagedata></shape></p>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">关系图：<span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体"><shape id="_x0000_i1028" style="width: 414.75pt; height: 314.25pt" type="#_x0000_t75"><imagedata src="file:///D:" o:title=""  Temp?msohtml1?01?clip_image006.emz?><img title="点击囄���可在新窗口打开" style="cursor: pointer" height="419" alt="clip_image003.gif" src="http://www.aygfsteel.com/images/blogjava_net/anwenhao/clip_image003.gif" width="553" border="0" /></imagedata></shape> </span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体"><shape id="_x0000_i1029" style="width: 414.75pt; height: 553.5pt" type="#_x0000_t75"><imagedata src="file:///D:" o:title=""  Temp?msohtml1?01?clip_image008.emz?><img title="点击囄���可在新窗口打开" style="cursor: pointer" height="739" alt="未命�?bmp" src="http://www.aygfsteel.com/images/blogjava_net/anwenhao/未命�?bmp" width="603" border="0" /></imagedata></shape> </span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt 21.25pt; text-indent: -21.25pt; line-height: 150%; text-align: left; tab-stops: list 21.25pt" align="left"><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">3<span style="font: 7pt 'Times New Roman'">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span></strong><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">分析�Q?span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;&nbsp;&nbsp;</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">�Ҏ��以上的类关系囑֒�ER囑֏�以看出。整个权限可以抽象�ؓ五个<a onclick="javascript:tagshow(event, '%B6%D4%CF%F3');" href="javascript:;" target="_self"><u><strong>对象</strong></u></a>�l�成�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">OrgBean :</span></strong><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">用于描述org模型�?span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">Role</span></strong><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">�Q?用于描述角色�?span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">Permission</span></strong><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">�Q?用于描述权限�?span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">Resource</span></strong><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">�Q?用于描述资源�?span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">Operation</span></strong><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">�Q?用于描述操作�?span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; color: #3366ff; line-height: 150%; font-family: 宋体">其中Permission中有Resource , Operation的聚合，资源和操作组成权限�?span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; color: #3366ff; line-height: 150%; font-family: 宋体">Role</span></strong><strong><span style="font-size: 12pt; color: #3366ff; line-height: 150%; font-family: 宋体">和Permission都有自包含。因�����计到权限的���ѝ�?span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; color: #3366ff; line-height: 150%; font-family: 宋体">资源Resource也可能出��C��颗树形结构，那资源也要有自包含�?span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 14pt; color: black; line-height: 150%; font-family: 宋体">思想</span></strong><strong><span style="font-size: 14pt; color: black; line-height: 150%">: </span></strong>
<p style="margin: 0cm 0cm 0pt; text-indent: 21pt; text-align: left" align="left"><span style="font-size: 12pt; color: black; font-family: 宋体">权限�pȝ��的核心由以下三部分构成：</span><span style="font-size: 12pt; color: black; font-family: Arial">1.</span><span style="font-size: 12pt; color: black; font-family: 宋体">创造权限，</span><span style="font-size: 12pt; color: black; font-family: Arial">2.</span><span style="font-size: 12pt; color: black; font-family: 宋体">分配权限�Q?/span><span style="font-size: 12pt; color: black; font-family: Arial">3.</span><span style="font-size: 12pt; color: black; font-family: 宋体">使用权限�Q�然后，�pȝ��各部分的主要参与者对照如下：</span><span style="font-size: 12pt; color: black; font-family: Arial">1.</span><span style="font-size: 12pt; color: black; font-family: 宋体">创造权�?/span><span style="font-size: 12pt; color: black; font-family: Arial">-</span><span style="font-size: 12pt; font-family: Arial">Creator</span><span style="font-size: 12pt; color: black; font-family: 宋体">创造，</span><span style="font-size: 12pt; color: black; font-family: Arial">2.</span><span style="font-size: 12pt; color: black; font-family: 宋体">分配权限</span><span style="font-size: 12pt; color: black; font-family: Arial">- Administrator</span><span style="font-size: 12pt; color: black; font-family: 宋体">分配�Q?/span><span style="font-size: 12pt; color: black; font-family: Arial">3.</span><span style="font-size: 12pt; color: black; font-family: 宋体">使用权限</span><span style="font-size: 12pt; color: black; font-family: Arial">- User</span><span style="font-size: 12pt; font-family: 宋体">�Q?span> </span></span>
<p style="margin: 0cm 0cm 0pt; text-indent: 21pt; text-align: left" align="left"><span style="font-size: 12pt; font-family: Arial">1.<span style="color: black">Creator</span></span><span style="font-size: 12pt; color: black; font-family: 宋体">创�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Privilege</span><span style="font-size: 12pt; font-family: 宋体">�Q?/span><span style="font-size: 12pt; font-family: Arial">Creator</span><span style="font-size: 12pt; font-family: 宋体">在设计和实现�pȝ��时会划分�Q�一个子�pȝ��或称为模块，应该有哪些权限。这里完成的�?/span><span style="font-size: 12pt; font-family: Arial">Privilege</span><span style="font-size: 12pt; font-family: 宋体">�?/span><span style="font-size: 12pt; font-family: Arial">Resource</span><span style="font-size: 12pt; font-family: 宋体">的对象声明，�q�没有真正将</span><span style="font-size: 12pt; font-family: Arial">Privilege</span><span style="font-size: 12pt; font-family: 宋体">与具�?/span><span style="font-size: 12pt; font-family: Arial">Resource</span><span style="font-size: 12pt; font-family: 宋体">实例联系在一��P��形成</span><span style="font-size: 12pt; font-family: Arial">Operator</span><span style="font-size: 12pt; font-family: 宋体">�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; text-indent: 21pt; text-align: left" align="left"><span style="font-size: 12pt; font-family: Arial">2.<span style="color: black">Administrator</span></span><span style="font-size: 12pt; color: black; font-family: 宋体">指定</span><span style="font-size: 12pt; color: black; font-family: Arial">Privilege</span><span style="font-size: 12pt; color: black; font-family: 宋体">�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Resource Instance</span><span style="font-size: 12pt; color: black; font-family: 宋体">的关�?/span><span style="font-size: 12pt; font-family: 宋体">。在�q�一步，</span><span style="font-size: 12pt; font-family: 宋体">权限真正与资源实例联�p�d��了一��P��</span><span style="font-size: 12pt; font-family: 宋体">产生�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Operator</span><span style="font-size: 12pt; font-family: 宋体">�Q?/span><span style="font-size: 12pt; font-family: Arial">Privilege Instance</span><span style="font-size: 12pt; font-family: 宋体">�Q��?/span><span style="font-size: 12pt; color: black; font-family: Arial">Administrator</span><span style="font-size: 12pt; color: black; font-family: 宋体">利用</span><span style="font-size: 12pt; color: black; font-family: Arial">Operator</span><span style="font-size: 12pt; color: black; font-family: 宋体">�q�个基本元素�Q�来创造他理想中的权限模型。如�Q�创������Ԍ��创徏用户�l�，�l�用��L��分配用户�Q�将用户�l�与角色兌����{�等</span><span style="font-size: 12pt; color: black; font-family: Arial">...</span><span style="font-size: 12pt; color: black; font-family: 宋体">�q�些操作都是�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Administrator</span><span style="font-size: 12pt; color: black; font-family: 宋体">来完成的�?/span><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt; text-indent: 21pt; text-align: left" align="left"><span style="font-size: 12pt; color: black; font-family: Arial">3. User</span><span style="font-size: 12pt; color: black; font-family: 宋体">使用</span><span style="font-size: 12pt; color: black; font-family: Arial">Administrator</span><span style="font-size: 12pt; color: black; font-family: 宋体">分配�l�的权限��M��用各个子�pȝ���?/span><span style="font-size: 12pt; color: black; font-family: Arial">Administrator</span><span style="font-size: 12pt; color: black; font-family: 宋体">是用��P��在他的心目中有一个比较适合他管理和�l�护的权限模型。于是，�E�序员只要回�{�一个问题，���是什么权限可以访问什么资源，也就是前面说�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Operator</span><span style="font-size: 12pt; color: black; font-family: 宋体">。程序员提供</span><span style="font-size: 12pt; color: black; font-family: Arial">Operator</span><span style="font-size: 12pt; color: black; font-family: 宋体">���意味着�l�系�l�穿上了盔甲�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Administrator</span><span style="font-size: 12pt; color: black; font-family: 宋体">���可以按照他的意愿来建立他所希望的权�?a onclick="javascript:tagshow(event, '%BF%F2%BC%DC');" href="javascript:;" target="_self"><u><strong>框架</strong></u></a></span><span style="font-size: 12pt; font-family: 宋体">可以自行增加�Q�删除，���理</span><span style="font-size: 12pt; font-family: Arial">Resource</span><span style="font-size: 12pt; font-family: 宋体">�?/span><span style="font-size: 12pt; font-family: Arial">Privilege</span><span style="font-size: 12pt; font-family: 宋体">之间关系。可以自行设定用�?/span><span style="font-size: 12pt; font-family: Arial">User</span><span style="font-size: 12pt; font-family: 宋体">和角�?/span><span style="font-size: 12pt; font-family: Arial">Role</span><span style="font-size: 12pt; font-family: 宋体">的对应关�p�R�?/span><span style="font-size: 12pt; color: black; font-family: Arial">(</span><span style="font-size: 12pt; color: black; font-family: 宋体">如果��?/span><span style="font-size: 12pt; font-family: Arial">Creator</span><span style="font-size: 12pt; color: black; font-family: 宋体">看作�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Basic</span><span style="font-size: 12pt; color: black; font-family: 宋体">的发明者，</span><span style="font-size: 12pt; color: black; font-family: Arial">Administrator</span><span style="font-size: 12pt; color: black; font-family: 宋体">���是</span><span style="font-size: 12pt; color: black; font-family: Arial">Basic</span><span style="font-size: 12pt; color: black; font-family: 宋体">的��用者，他可以做一些脚本式的编�E?/span><span style="font-size: 12pt; color: black; font-family: Arial">) Operator</span><span style="font-size: 12pt; color: black; font-family: 宋体">是这个系�l�中最关键的部分，它是一个纽带，一个系�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Programmer</span><span style="font-size: 12pt; color: black; font-family: 宋体">�Q?/span><span style="font-size: 12pt; color: black; font-family: Arial">Administrator</span><span style="font-size: 12pt; color: black; font-family: 宋体">�Q?/span><span style="font-size: 12pt; color: black; font-family: Arial">User</span><span style="font-size: 12pt; color: black; font-family: 宋体">之间的纽带�?/span><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong></strong>
<p style="margin: 0cm 0cm 0pt 21.25pt; text-indent: -21.25pt; line-height: 150%; text-align: left; tab-stops: list 21.25pt" align="left"><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">4<span style="font: 7pt 'Times New Roman'">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span></strong><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">权限<span>API </span></span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;<strong>&nbsp;getPermissionByOrgGuid(String orgGuid ) </strong></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">通过传入一个org的Guid�Q?拿到当前�q�个org对象都具有那些访问权限�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;getSourcePermissionByOrgGuid(String orgGuid , String resouceGuid) </span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;&nbsp;&nbsp;</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">通过传入一个org的Guid�?一个资源的Guid�Q?�q�回改Org对当前这个资源的讉K��权限�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">getPermissionByResourceGuid(String resource) </span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;&nbsp;&nbsp;</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">通过传入一个资源的Guid�Q?得到当前资源下都有那些权限定义�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">havingHeritPermission(String orgGuid , String resouceGuid) : Boolean </span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;&nbsp;&nbsp;</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">传入一个orgGuid�Q?资源GUID�Q�查看改OrgGuid下对资源是否有向下��承的权限。这里��承是资源的���ѝ��即对父栏目有权限，可以�l�承下去对父栏目下的子栏目同��h��权限�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">havingPermission(String orgGuid , String resourceGuid) : Boolean </span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;&nbsp;&nbsp;</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">判断某Org�Ҏ��一资源是否用权限�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">以上是粗�_�度的权限API�?以下为细�_�度的权限：<span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">getOperationByPermission(String permissionGuid) </span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;&nbsp;&nbsp;</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">通过permission的Guid得到该permission的所有有效操作�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">getOperationByGuid(String permissionGuid , String resourceGuid) </span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;&nbsp;&nbsp;</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">通过permision的Guid�Q?资源的Guid得到该资源下所有的有效操作�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">screeningOpreationByGuid (String permissionGuid , String resourceGuid , String orgGuid) </span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;&nbsp;&nbsp;</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">通过permission�Q�resource�Q�org的Guid得到改Org对这一资源的有效操作�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><strong><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">hasOperation(String operationGuid) : boolean </span></strong>
<p style="margin: 0cm 0cm 0pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">&nbsp;&nbsp;&nbsp;</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">通过传入的operationGuid�q�回是否��h��操作权限�?span> </span></span>
<p style="margin: 0cm 0cm 0pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt 21.25pt; text-indent: -21.25pt; line-height: 150%; text-align: left; tab-stops: list 21.25pt" align="left"><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">5<span style="font: 7pt 'Times New Roman'">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span></strong><strong><span style="font-size: 16pt; line-height: 150%; font-family: 宋体">权限的实玎ͼ�<span> </span></span></strong>
<p style="margin: 0cm 0cm 0pt 21pt; text-align: left" align="left"><span style="font-size: 12pt; color: black; font-family: Arial">1</span><span style="font-size: 12pt; color: black; font-family: 宋体">�Q�表单式认证�Q�这是常用的�Q�但用户到达一个不被授权访问的资源�Ӟ��</span><span style="font-size: 12pt; color: black; font-family: Arial">Web</span><span style="font-size: 12pt; color: black; font-family: 宋体">容器���发</span><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt; text-align: left" align="left"><span style="font-size: 12pt; color: black; font-family: 宋体">��Z���?/span><span style="font-size: 12pt; color: black; font-family: Arial">html</span><span style="font-size: 12pt; color: black; font-family: 宋体">��面�Q�要求输入用户名和密码�?/span><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt 21pt; text-align: left" align="left"><span style="font-size: 12pt; color: black; font-family: Arial">2</span><span style="font-size: 12pt; color: black; font-family: 宋体">�Q�用</span><span style="font-size: 12pt; color: black; font-family: Arial">Filter</span><span style="font-size: 12pt; color: black; font-family: 宋体">防止用户讉K��一些未被授权的资源�Q?/span><span style="font-size: 12pt; color: black; font-family: Arial">Filter</span><span style="font-size: 12pt; color: black; font-family: 宋体">会截取所�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Request/Response</span><span style="font-size: 12pt; color: black; font-family: 宋体">�Q?/span><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt; text-align: left" align="left"><span style="font-size: 12pt; color: black; font-family: 宋体">然后攄���一个验证通过的标识在用户�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Session</span><span style="font-size: 12pt; color: black; font-family: 宋体">中，然后</span><span style="font-size: 12pt; color: black; font-family: Arial">Filter</span><span style="font-size: 12pt; color: black; font-family: 宋体">每次依靠�q�个标识来决定是否放�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Response</span><span style="font-size: 12pt; color: black; font-family: 宋体">�?/span><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt; text-indent: 21pt; text-align: left" align="left"><span style="font-size: 12pt; color: black; font-family: 宋体">�q�个模式分�ؓ�Q?/span><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt 21pt; text-align: left" align="left"><span style="font-size: 12pt; color: black; font-family: Arial">Gatekeeper</span><span style="font-size: 12pt; color: black; font-family: 宋体">�Q�采�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Filter</span><span style="font-size: 12pt; color: black; font-family: 宋体">或统一</span><span style="font-size: 12pt; color: black; font-family: Arial">Servlet</span><span style="font-size: 12pt; color: black; font-family: 宋体">的方式�?/span><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt 21pt; text-align: left" align="left"><span style="font-size: 12pt; color: black; font-family: Arial">Authenticator</span><span style="font-size: 12pt; color: black; font-family: 宋体">�Q?/span><span style="font-size: 12pt; color: black; font-family: 宋体">�?/span><span style="font-size: 12pt; color: black; font-family: Arial">Web</span><span style="font-size: 12pt; color: black; font-family: 宋体">中���?/span><span style="font-size: 12pt; color: black; font-family: Arial">JAAS</span><span style="font-size: 12pt; color: black; font-family: 宋体">自己来实现�?/span><span style="font-size: 12pt; font-family: 宋体"> </span>
<p style="margin: 0cm 0cm 0pt; text-indent: 21pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; text-indent: 21pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">Filter</span><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">拦截只是拦截该用��h��否有讉K���q�个��面�Q�或�q�一资源的权限。真正做到显�C�后拦截是在应用�E�序内部��d���?span> </span></span>
<p style="margin: 0cm 0cm 0pt; text-indent: 21pt; line-height: 150%">
<p style="margin: 0cm 0cm 0pt; text-indent: 21pt; line-height: 150%"><span style="font-size: 12pt; line-height: 150%; font-family: 宋体">做显�C�拦截提供API�Q?标签�q�两�U�方式�?/p>
</span><br />
<img src ="http://www.aygfsteel.com/caizh2009/aggbug/270622.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/caizh2009/" target="_blank">���菜毛毛</a> 2009-05-14 15:47 <a href="http://www.aygfsteel.com/caizh2009/articles/270622.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item></channel></rss>                                                                                                         <footer>
<div class="friendship-link">
<a href="http://www.aygfsteel.com/" title="&#29408;&#29408;&#20037;&#20037;&#20122;&#27954;&#27431;&#32654;&#19987;&#21306;&#95;&#20013;&#25991;&#23383;&#24149;&#20122;&#27954;&#32508;&#21512;&#20037;&#20037;&#50;&#48;&#50;&#95;&#22269;&#20135;&#31934;&#21697;&#20122;&#27954;&#31532;&#20116;&#21306;&#22312;&#32447;&#95;&#26085;&#26412;&#20813;&#36153;&#32593;&#31449;&#35270;&#39057;">&#29408;&#29408;&#20037;&#20037;&#20122;&#27954;&#27431;&#32654;&#19987;&#21306;&#95;&#20013;&#25991;&#23383;&#24149;&#20122;&#27954;&#32508;&#21512;&#20037;&#20037;&#50;&#48;&#50;&#95;&#22269;&#20135;&#31934;&#21697;&#20122;&#27954;&#31532;&#20116;&#21306;&#22312;&#32447;&#95;&#26085;&#26412;&#20813;&#36153;&#32593;&#31449;&#35270;&#39057;</a>

</div>

</footer>


��վ֩���ģ�壺
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">̩����</a>|
<a href="http://" target="_blank">�����</a>|
<a href="http://" target="_blank">��ɽ��</a>|
<a href="http://" target="_blank">�����</a>|
<a href="http://" target="_blank">�ϳ���</a>|
<a href="http://" target="_blank">��Դ��</a>|
<a href="http://" target="_blank">���ױ�����</a>|
<a href="http://" target="_blank">��Դ��</a>|
<a href="http://" target="_blank">��Դ��</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">ϰˮ��</a>|
<a href="http://" target="_blank">��������</a>|
<a href="http://" target="_blank">�ݳ���</a>|
<a href="http://" target="_blank">�ն���</a>|
<a href="http://" target="_blank">ͬ����</a>|
<a href="http://" target="_blank">��ɽ</a>|
<a href="http://" target="_blank">����������</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">�ij���</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">�ں���</a>|
<a href="http://" target="_blank">��ͷ����</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">��Ͷ��</a>|
<a href="http://" target="_blank">Ӫɽ��</a>|
<a href="http://" target="_blank">�ﴨ��</a>|
<a href="http://" target="_blank">�˶���</a>|
<a href="http://" target="_blank">��ͷ����</a>|
<a href="http://" target="_blank">�ֱ���</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">Խ����</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">�ղ���</a>|
<a href="http://" target="_blank">��Ĭ������</a>|
<a href="http://" target="_blank">��</a>|
<a href="http://" target="_blank">ĵ������</a>|
<a href="http://" target="_blank">��ƽ��</a>|
<script>
(function(){
    var bp = document.createElement('script');
    var curProtocol = window.location.protocol.split(':')[0];
    if (curProtocol === 'https') {
        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
    }
    else {
        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
    }
    var s = document.getElementsByTagName("script")[0];
    s.parentNode.insertBefore(bp, s);
})();
</script>
</body>