后台和前端分离

Question

We are implementing identity 2.0 with an admin CMS and a login area for front end users.

Should they be separated by Role alone? So admins have their own roles and front end users have their own roles? Then just redirect after login and authenticate by role depending on if you are in /userarea/ (front end users) and /cms/ (back office)?

On that note since it's cookie based do you have to redirect before you can check the signed in user against their roles?

Answer 1

Separation by Role would be the most common way of doing this. That said, these Roles can be assigned with much more granularity then top-level objects (folders) on your site. For example, there could be a /userarea/admins/ with the Admin Role.

There are also security levels being assigned to the individual Roles. Where the entire path of the object is checked, and the highest (or most restrictive) 'level' of security assigned to any part the path, would be selected, and the user would have to be a member of that Role to be allowed access.

The redirection is redirecting the user to the authentication service, which is often a different system from the ones providing the sites pages. After the user has been authenticated, he or she is provided with an cookie containing a unique identifier that would tell your security proxy server which objects said user had access to.