简体繁体 English

如何在Ldap中集成用户权限

[英]How to integrate User permissions in Ldap

原文 2013-10-21 06:50:10 4 1 java/ spring/ authentication/ spring-security/ authorization

My target it so assign to user permissions. 我的目标就是分配给用户权限。 For example: 例如：

User "John" belong to role ROLE_CUSTOMERS and have the permissions of: 'READ_MAILS", 'ADD_MAILS'. 用户“John”属于角色ROLE_CUSTOMERS，拥有以下权限：'READ_MAILS'，'ADD_MAILS'。

User "David" belong to role ROLE_USERS and have the permissions of: 'DELETE_MAILS' 用户“David”属于角色ROLE_USERS，拥有以下权限：'DELETE_MAILS'

I managed to map users and roles to the ldap directory. 我设法将用户和角色映射到ldap目录。 Users -> John,David Groups -> ROLES_CUSTOMER,ROLE_USERS 用户 - > John，David Groups - > ROLES_CUSTOMER，ROLE_USERS

But I am missing the permissions part. 但我错过了权限部分。

I don't know how to declare the 'READ_MAILS", 'DELETE_MAILS','ADD_MAILS' attributes/permissions/task or however you call it. 我不知道如何声明'READ_MAILS'，'DELETE_MAILS'，'ADD_MAILS'属性/权限/任务，或者你可以调用它。

How I assign each permission to a user at the ldap side? 我如何在ldap端为用户分配每个权限？
How ill be able to retrieve those permissions in the spring security side before letting a specific user do some operation. 在让特定用户执行某些操作之前，如何能够在spring安全端检索这些权限。

*I am not sure this requirement I am looking for called 'permission' please correct me if I wrong. *我不确定我要求的这个要求被称为“许可”，如果我错了请纠正我。

thanks, ray. 谢谢，雷。

1 个解决方案

What you are looking for is fine-grained permissions / entitlements. 您正在寻找的是细粒度的权限/权利。 Those are not typically stored in LDAP but rather in another solution eg an authorization service. 这些通常不存储在LDAP中，而是存储在另一个解决方案中，例如授权服务。

With respect to Spring Security, this article may help. 关于Spring Security，本文可能有所帮助。 Also consider the Spring API documentation on permissions . 还要考虑有关权限的Spring API文档。

I would recommend you consider a standards-based approach using XACML, the eXtensible Access Control Markup Language. 我建议您考虑使用可扩展访问控制标记语言XACML的基于标准的方法。 With XACML you use roles that come from LDAP and then you write rules eg a manager can edit accounts that are in the same region as the user. 使用XACML，您可以使用来自LDAP的角色，然后编写规则，例如a manager can edit accounts that are in the same region as the user. . 。 Check out XACML either at the OASIS website or on Wikipedia for some more information. 有关更多信息，请访问OASIS网站或Wikipedia上查看XACML。