许可系统最有效的/简单的方法？ [英] Most efficient/easy method for permission system?

问题描述

我创建使用CakePHP的应用程序，并试图找出一个权限系统，为应用程序时，都创下了心理障碍。我已经把范围缩小到了几个不同的方法，我在找一些有关这将是一个）最容易实施和b）最有效的（当然可以有权衡这两者之间）。

I'm creating an app using CakePHP and have hit a mental barrier when trying to figure out a permission system for the app. I've narrowed it down to a couple different methods, and I'm looking for some information about which would be a) most easily implemented and b) most efficient (obviously there can be trade-off between these two).

该应用程序有许多不同的模式，但为了简化我只使用用户，部门和事件。我希望能够单独控制CRUD权限的每个用户，对每一个模型

The app has many different models, but for simplification I'll just use User, Department, and Event. I want to be able to individually control CRUD permissions for each user, on each model.

虽然不良记录，我已经得到了一定程度的的ACL系统是如何工作的，并认为创造的ARO如下：

Though poorly documented, I've got somewhat of an idea of how the ACL system works, and considered creating AROs as follows:

[1]user
    create
    read
    update
    delete
[2]department
    ...

等。这需要用户是的许多的不同群体，从我所看到的，蛋糕不容易支持此功能。有没有可能是一个更好的方式来做到这一点，或者说是ACL不适合这种情况？

etc. This would require users being in many different groups, and from what I've seen, Cake doesn't easily support this. Is there possibly a better way to do this, or is ACL not suitable for this situation?

这一个是pretty直白，显然有在用户的记录标志
create_users ， read_users ，等有了4-5车型，这将意味着权限16-20领域，这使我认为无论是使用位掩码，或者使用一个连接表。就是其中之一比其他的更好吗？哪一个是用更少的开销更快？

This one is pretty straightforward, obviously having a flag in the user's record for create_users, read_users, etc. With 4-5 models, this would mean 16-20 fields for permissions, which made me consider either using bit masks, or using a joined table. Is one of these better than the other? Which one is faster with less overhead?

总之，我想我真的想知道是什么方法最有意义的应用规模从效率和易用性的发展角度来看。我也开到如何去了解这一点，如果你从过去的项目经验其他建议。在此先感谢！

Overall, I guess I really want to know what approach makes the most sense in the scale of the application from an efficiency and ease-of-development standpoint. I'm also open to other suggestions of how to go about this, if you have experience from a past project. Thanks in advance!

推荐答案

这通常是我如何设置权限 - 你有动作可以执行，角色，可以执行这些动作和用户谁拥有角色。我在这里把这些例子根据您请求的是什么，虽然我想你会发现它难得你有谁可以做什么，但创建新的用户记录或更新部门的记录。

This is generally how I set up permissions - you have actions that can be performed, roles that can perform those actions and users who have roles. The examples I've put here are based on what you've requested though I think you'll find it rare you have a user who can do nothing but "create new user records" or "update department records".

actions
    id              varchar(50)
    description     varchar(200)

+-------------------+----------------------------------------------+
|    id             | description                                  |
+-------------------+----------------------------------------------+
| USER_CREATE       | Allow the user to create USERS records.      |
| USER_DELETE       | Allow the user to delete USERS records.      |
| USER_READ         | Allow the user to read USERS records.        |
| USER_UPDATE       | Allow the user to update USERS records.      |
| DEPARTMENT_CREATE | Allow the user to create DEPARTMENT records. |
| ................. | ............................................ |
+-------------------+----------------------------------------------+

roles
    id              unsigned int(P)
    description     varchar(50)

+----+--------------------+
| id | description        |
+----+--------------------+
|  1 | Manage users       |
|  2 | Manage departments |
| .. | .................. |
+----+--------------------+

roles_actions
    id              unsigned int(P)
    role_id         unsigned int(F roles.id)
    action_id       varchar(50)(F actions.id)

+----+---------+-------------------+
| id | role_id | action_id         |
+----+---------+-------------------+
|  1 |       1 | USER_CREATE       |
|  2 |       1 | USER_DELETE       |
|  3 |       1 | USER_READ         |
|  4 |       1 | USER_UPDATE       |
|  5 |       2 | DEPARTMENT_CREATE |
|  6 |       2 | DEPARTMENT_DELETE |
| .. | ....... | ................. |
+----+---------+-------------------+

users
    id              unsigned int(P)
    username        varchar(32)(U)
    password        varchar(123) // Hashed, like my potatoes
    ...

+----+----------+----------+-----+
| id | username | password | ... |
+----+----------+----------+-----+
|  1 | bob      | ******** | ... |
|  2 | april    | ******** | ... |
|  3 | grant    | ******** | ... |
| .. | ........ | ........ | ... |
+----+----------+----------+-----+

users_roles
    id              unsigned int(P)
    user_id         unsigned int(F users.id)
    role_id         unsigned int(F roles.id)

+----+---------+---------+
| id | user_id | role_id |
+----+---------+---------+
|  1 |       1 |       1 |
|  2 |       2 |       2 |
| .. | ....... | ....... |
+----+---------+---------+

要确定用户是否具有您可以执行这样的查询特定权限：

To determine if a user has a particular permission you could execute a query like this:

SELECT COUNT( roles_actions.id )
FROM users
LEFT JOIN users_roles ON users.id = users_roles.user_id
LEFT JOIN roles_actions ON users_roles.role_id = roles_actions.role_id
WHERE roles_actions.action_id = '<action.id>'

这篇关于许可系统最有效的/简单的方法？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！