access rights management
In enterprise services, it is a basic service. Today I'm going to talk about its design.
There is a lot of information on the Internet, giving ER diagrams and class diagrams. It's all very well told, and I try it out in every scene. However, when using it, there is no problem in the early stage, but it is found that there is a big problem in the later stage.
The reason for analysis is to solve this problem from the perspective of development and think about ACL. There is no need to analyze ACLs from an operational point of view.
First of all, clarify some problems and misunderstandings:
-------------------------------------------- ----
ACL itself is only responsible for storage.
For a specific business, the data authority is divided according to which dimension, or it comes from the business, and the format in which it is stored is unknown to the ACL itself. The business just quickly establishes a data permission model based on ACL.
ACL is divided into functional permissions and data permissions
. Users can access the forms and pages, which belong to functional permissions. Multiple users access the same table, but see different data. This is data permission.
Correctly understand a lot of information on the relationship between roles, resources, and users
on the Internet, and abstract the three, which is very good. Can adapt to various scenarios. Perfect.
The emphasis here is that there is no uniform way to build a data model. to specific business. Specifically divided into the following
(1) User-role relationship (many-to-one)
In this model, no resources are required. For example, for my system users, I only want to provide some people with the function of sending emails. I only care about who to send emails to. The so-called functional permissions are delegated to the business code and do not need to be maintained in the ACL.
(2) Role-resource relationship (one-to-many)
The system will often create a report, and the newly created report should be assigned to the system user. Then, if a resource is newly created, dozens of users must be bound. Obviously, the operating cost will be very large. It is necessary to associate the user with the visual color in advance, and then bind the newly created resource to the role.
(3) Role-resource (many-to-many)
, for example, a nationwide sales force management system, resource grading, top-to-bottom: national, regional, provincial, municipal, and district
company personnel are associated with period resources. Moreover, this association relationship will be used in multiple business units, resulting in a weakening of the concept of roles and only concerned with data permissions.
(4) Account-role-resource
Three , two associated, plus one full. There are four scenes.
There is no need to use a unified way for storage, and the above model should be applied according to specific business scenarios.
There is no need to make all permissions into a fixed model, account-role-resource. This is inconvenient to understand.
Resource design, and query
I found that the information provided so far only emphasizes storage, not how to design the search interface. This is also the root cause of the ineffective use of ACL. To combine the above models, to develop a series of query interfaces, it is necessary to be close to the business and think in a different position.
Independently maintain user information of business lines
--------------------------------------- ---
The ACL management system I designed
can be seamlessly migrated to various company systems.
The reserved interface is connected with SSO.
Multiple lines of business can be used at once. After a business line is selected, all operations are performed under the business line.
Maintain accounts, roles, resources, and their mapping relationships.
Provides the function of batch upload. Bulk uploads can be made for accounts, roles, resources, and the three mapping relationships.
Provides rich query functions that can meet business needs.
The login function is provided by default. It is recommended to modify the code and access the company's SSO.
Special instructions:
Through storage and query, a complex business function is solved.
Resources:
1 West Lake District, Hangzhou City, Zhejiang Province, East China Region A
certain person may have multiple binding relationships with resources.
Finally, I want to know these binding relationships, which cities are involved, people may be bound to any level, and the pipeline data of a certain level needs to be returned.
A five-level tree structure, users may be bound to any level. Find the resources involved in a certain layer.
This requirement is long-lived and complicated to handle. The provided solution solves this problem.
The code has been implemented and will be uploaded to github later