如何在 Google App Engine 上使用 RBAC(或访问控制)? [英] How to use RBAC (or access control) on Google App Engine?

问题描述

是否有人在基于 GWT 的项目中使用了一些 RBAC(或其他访问控制)?应用引擎?
或者实际上如何管理基于角色的 GWT-RPC 调用?

Has anyone used some RBAC (or other access control) in a GWT based project deployed in App Engine?
Or actually how to manage GWT-RPC calls to by role based?

还是仅根据用户的登录凭据向客户端浏览器发送代码"更容易?

Or is it easier to only "send the code" to client browser based on user's login credentials?

想法、图书馆，一切都欢迎！

Ideas, libraries, all is welcome!

谢谢

推荐答案

您可以向用户类添加角色属性:

You could add a roles property to your user class:

class MyUser(db.Model):
  roles = db.ListProperty(db.Key)

class Role(db.Model):
  ...

然后，当您想知道用户是否可以做某事时，请执行以下操作:

Then, when you want to know whether a user can do something, do something like this:

if required_role in current_user.roles:
  do_the_thing()
else:
  warn_sternly()

您需要建模的是谁扮演什么角色.这是一种多对多关系(至少在大多数应用程序中).这是实现这种关系的一种方式，但还有其他方式，可能更适合您的情况.以下是对 App Engine 中的关系建模提供一些建议的页面:https://developers.google.com/appengine/articles/modeling

What you need to model is who is in what roles. This is a many-to-many relationship (at least, in most applications). This is one way to implement such a relationship, but there are other ways, which may be more appropriate to your situation. Here's a page that has some advice on relationship modeling in App Engine: https://developers.google.com/appengine/articles/modeling

这篇关于如何在 Google App Engine 上使用 RBAC(或访问控制)?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！