ASP.NET网站中的管理员角色管理 [英] Admin role management in ASP.NET website

问题描述

所以，大家好，我正在创建一个Quiz Hosting网站，只是为了娱乐，我正在将角色分配给管理员...有一个高级管理员，他可以执行/添加/编辑任何内容.但我希望其他管理员的权限受到限制.说一个只能添加/编辑问题和类别，而另一个只能处理测验付款.等等.

So, hey guys, I'm creating a Quiz Hosting website just for fun and I'm assigning roles to admin... There is a master admin, who can do/add/edit any and everything.. but I want privileges to other admins to be restricted.. say One can only add/edit questions and categories while other can only handles payments for quizzes..and so on

我的第一个问题是:这是一件好事，还是我应该说的，正确的事情?

My first question is: Is this a good or rather I should say,the CORRECT thing to do??

我的第二个问题:目前，我已经通过使用数字1到8来实现此特权.数字越高，特权越多.此方法可以吗?有没有改进的余地(我敢肯定有)还是有更好的方法?

My second question: Currently I have achieved this by using numbers 1 to 8 for privileges..the higher the number more the privileges.Is this method OK? is there any room for improvement(I'm sure there is)or is there a better method??

请朋友们在这方面指导我.THX

Kindly guide me in this respect friends.. THX

推荐答案

首先:

My first question is: Is this a good or rather I should say,the CORRECT 
thing to do??

除了您之外，没有人可以说这是好是坏，因为只有您最好地了解系统的逻辑，范围和可伸缩性.要点是，这取决于您的系统和要求.此外，您正在做的是一个非常常见的基于角色的操作场景，几乎可以在任何地方看到示例，无论是Windows OS，Sql Server还是典型的FB朋友列出隐私属性.

Nobody can say whether it is good or bad except you, because only you best understand the logics and scope and scalability of your system. Point is, it depends on your system and requirement. Moreover, what you are doing, is a very common Role based action scenario and you can see examples of it almost anywhere, be it Windows OS, or Sql Server, or your typical FB friends list privacy properties.

第二:

My second question: Currently I have achieved this by using numbers 1 to 8 for 
privileges..the higher the number more the privileges.Is this method OK?

再次，这完全是您的决定，没有人可以说这是好是坏，这完全取决于您的决定将使系统实现的简单或复杂.从更个人的角度来说，您不应基于数字的值绑定权限级别，而应为给定的特定角色获取任何唯一的标识符(数字或字符串)，并以映射表的形式为其分配特权即

Again, it is totally your decision, nobody can say whether it is good or bad, it all depends on how simple or complex this decision of yours is going to make implementation of your system. On a more personal note, you shouldn't tie up permission levels based on value of a number, rather, you should take any unique identifier(number or string) for a given specific role and assign it privileges in the form of a mapping table i.e.

RolePermissionMaster:

RoleId AppActivity
1          1
1          2
1          3
1          4
2          1

其中AppActivity是另一个定义1,2,3,4等的表即

where AppActivity is another table defining meaning of 1,2,3,4 and so on i.e.

AppActivityMaster:

 Id   Value
 1    READ
 2    EDIT
 3    DELETE
 4    CREATE

这篇关于ASP.NET网站中的管理员角色管理的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！