我一直在尝试“从字里行间”了解 NetSqlAzMan 项目最初(和/或当前)的动机。

这是为了什么而写的？

1. Windows 授权管理器 (AzMan) 的适配器。 NetSqlAzMan 中的方法只是将调用传递给 (Windows 授权管理器 (AzMan))，但可能使用更好/更清洁的方法？

2. (Windows 授权管理器 (AzMan))的替代品。其中(大部分或全部)(Windows 授权管理器 (AzMan))中可用的功能在 NetSqlAzMan 中重新创建，但代码是独立开发的。 (也许提供 DotNet 4.0 支持？？？)(也许移除任何 COM 依赖)

3. 提供比 (Windows Authorization Manager (AzMan)) 提供的更多的功能。也就是(Windows 授权管理器 (AzMan))的“更智能”/“更好”版本。

4. 通过开源重写并保持一个半死的项目。 (例如，也许 (Windows Authorization Manager (AzMan))) 是微软的一个死掉或废弃的项目)。

5. 其他？

................

我喜欢 NetSqlAzMan 的对象模型。但我需要向我的项目经理和其他开发人员捍卫使用它的任何决定。 就我对安全性的期望而言，对象模型似乎“恰到好处”(想想 goldilocks 和中间床)。 我不想做基于角色的安全。我想要基于权利(或任务或许可)的安全性。

(参见: http://lostechies.com/derickbailey/2011/05/24/dont-do-role-based-authorization-checks-do-activity-based-checks/ 和 http://granadacoder.wordpress.com/2010/12/01/rant-hard-coded-security-roles/ )

基本上出现的问题是:“使用 NetSqlAzMan 而不是 (Windows Authorization Manager (AzMan)) 有什么优势？”

子问题是“Windows 授权管理器 (AzMan) 死了吗？”。 (以及与 Long Live NetSqlAzMan 类似的东西!)。

......................

我的一般要求是:

非 Active Directory 用户。 (将来 Active Directory 和/或 LDAP 支持会很好，但不是必需的)。 密码未存储为纯文本。 能够处理 RIGHTS 进行安全检查。
将权限分组到任何角色下。 为用户分配角色。 (但同样，代码将检查权限，而不是执行操作时的角色。) 允许(有时)将权限分配给用户。使用拒绝覆盖。 (也就是说，一个人做了愚蠢的事情(比如“删除员工”)可以撤销该权利。) 可以为多个应用维护角色和权限。

欢迎提出其他想法。但是Windows Identity Foundation似乎有点矫枉过正。

谢谢。

最佳答案

昨晚终于找到了一篇“比较”的文章。

http://www.c-sharpcorner.com/uploadfile/a.ferendeles/netsqlazman12122006123316pm/netsqlazman.aspx

我将在此处(下方)粘贴相关部分。 (以防万一该网站将来不复存在。我知道机会很小，但我讨厌“答案就在这里”链接，当您点击该链接时，它就死了。)

据我所知。

NetSqlAzMan 提供了一个(表)用户定义函数，您可以重载该函数以提供用户列表(要分配给角色/任务)。 NetSqlAzMan 不仅提供“Yeah you can”映射 (Grant)，还提供 Deny 和 Grant-With-Delegate。 NetSqlAzMan 和 Azman 允许用户(组)角色映射。只有 NetSqlAzMan 允许用户任务映射。

看了几个示例之后……NetSqlAzMan 的对象模型非常干净。

============================================= ========

Ms Authorization Manager (AzMan) vs .NET Sql Authorization Manager (NetSqlAzMan)

As pointed out before, an analogous Microsoft product already exists and is called Authorization Manager (AzMan); AzMan is present, by default, in Windows Server 2003 and, through the Admin Pack setup, in Windows XP.

The important difference between AzMan and NetSqlAzMan is that the first is Role-based, that is, based on the belonging - Role concept and the operations container in each role, while the second is Item-based (or if you prefer Operation-based), that is users or users group or group of groups that can or cannot belong to Roles or execute such Task and/or Operations (Items).

Here the most important features and differences between the two products:

Ms AzMan:

* It's COM.
* It's equipped by a MMC 2.0 (COM) console.
* Its storage can be an XML file or ADAM (Active Directory Application Mode - e un LDAP).
* It's role-based.
* It supports static/dynamic applicative groups, members/not-members.
* Structure based on Roles -> Tasks -> Operations. (Hierarchical Roles and Tasks , none Operations).
* Authorizations can be added only to Roles.
* It doesn't implement the "delegate" concept.
* It doesn't manage authorizations "in the time".
* It doesn't trigger events.
* The only type of authorization is "Allow".
  (to "deny" it needs to remove the user/group from his Role).
* It supports Scripting / Biz rules.
* It supports Active Directory users/groups and ADAM users.

NetSqlAzMan:

* It's .NET 2.0.
* It's equipped by a MMC 3.0 (.NET) console.
* Its storage is a Sql Server database(2000/MSDE/2005/Express).
* It's based on Tdo - Typed Data Object technology.
* It's Item-based.
* Structure based on Roles -> Tasks -> Operations. (all hierarchical ones).
* Authorizations can be added to Roles, Task and Operations.
* It supports static/dynamic applicative groups, members/not-members.
* LDAP query testing directly from console.
* It's time-dependant.
* It's delegate-compliant.
* It triggers events (ENS).
* It supports 4 authorization types:
      o Allow with delegation (authorized and authorized to delegate).
      o Allow (authorized).
      o Deny (not authorized).
      o Neutral (neutral permission, it depends on higher level Item permission).
* Hierarchical authorizations.
* It supports Scripting / Biz rules (compiled in .NET - C# - VB - and not interpreted)
* It supports Active Directory users/groups and custom users defined in SQL Server Database.

这是另一个问题。

阿兹曼示例代码: http://channel9.msdn.com/forums/sandbox/252978-AzMan-in-the-Enterprise-Sample-Code http://channel9.msdn.com/forums/sandbox/252973-Programming-AzMan-Sample-Code

using System;
using System.Security.Principal;
using System.Runtime.InteropServices;
using AZROLESLib;

namespace TreyResearch {
    public class AzManHelper : IDisposable {

        AzAuthorizationStore store;
        IAzApplication app;
        string appName;

        public AzManHelper(string connectionString, string appName) {

            this.appName = appName;

            try {
                // load and initialize the AzMan runtime
                store = new AzAuthorizationStore();
                store.Initialize(0, connectionString, null);

                // drill down to our application
                app = store.OpenApplication(appName, null);
            }
            catch (COMException x) {
                throw new AzManException("Failed to initizlize AzManHelper", x);
            }
            catch (System.IO.FileNotFoundException x) {
                throw new AzManException(string.Format("Failed to load AzMan policy from {0} - make sure your connection string is correct.", connectionString), x);
            }
        }

        public void Dispose() {
            if (null == app) return;

            Marshal.ReleaseComObject(app);
            Marshal.ReleaseComObject(store);

            app = null;
            store = null;
        }

        public bool AccessCheck(string audit, Operations op,
                                WindowsIdentity clientIdentity) {

            try {
                // first step is to create an AzMan context for the client
                // this looks at the security identifiers (SIDs) in the user's
                // access token and maps them onto AzMan roles, tasks, and operations
                IAzClientContext ctx = app.InitializeClientContextFromToken(
                    (ulong)clientIdentity.Token.ToInt64(), null);

                // next step is to see if this user is authorized for
                // the requested operation. Note that AccessCheck allows
                // you to check multiple operations at once if you desire
                object[] scopes = { "" };
                object[] operations = { (int)op };
                object[] results = (object[])ctx.AccessCheck(audit, scopes, operations,
                                                             null, null, null, null, null);
                int result = (int)results[0];
                return 0 == result;
            }
            catch (COMException x) {
                throw new AzManException("AccessCheck failed", x);
            }
        }

        public bool AccessCheckWithArg(string audit, Operations op,
                                       WindowsIdentity clientIdentity,
                                       string argName, object argValue) {

            try {
                // first step is to create an AzMan context for the client
                // this looks at the security identifiers (SIDs) in the user's
                // access token and maps them onto AzMan roles, tasks, and operations
                IAzClientContext ctx = app.InitializeClientContextFromToken(
                    (ulong)clientIdentity.Token.ToInt64(), null);

                // next step is to see if this user is authorized for
                // the requested operation. Note that AccessCheck allows
                // you to check multiple operations at once if you desire
                object[] scopes = { "" };
                object[] operations = { (int)op };
                object[] argNames = { argName };
                object[] argValues = { argValue };
                object[] results = (object[])ctx.AccessCheck(audit, scopes, operations,
                                                             argNames, argValues,
                                                             null, null, null);
                int result = (int)results[0];
                return 0 == result;
            }
            catch (COMException x) {
                throw new AzManException("AccessCheckWithArg failed", x);
            }
        }

        // use this to update a running app
        // after you change the AzMan policy
        public void UpdateCache() {
            try {
                store.UpdateCache(null);
                Marshal.ReleaseComObject(app);
                app = store.OpenApplication(appName, null);
            }
            catch (COMException x) {
                throw new AzManException("UpdateCache failed", x);
            }
        }
    }

    public class AzManException : Exception {
        public AzManException(string message, Exception innerException)
          : base(message, innerException)
        {}
    }
}

那是 Azman 助手代码。那是丑陋的 COM/Interopish 东西。 :

现在检查 NetSqlAzMan 代码示例:

http://netsqlazman.codeplex.com/wikipage?title=Samples

/// <summary>
/// Create a Full Storage through .NET code
/// </summary>
private void CreateFullStorage()
{
    // USER MUST BE A MEMBER OF SQL DATABASE ROLE: NetSqlAzMan_Administrators

    //Sql Storage connection string
    string sqlConnectionString = "data source=(local);initial catalog=NetSqlAzManStorage;user id=netsqlazmanuser;password=password";
    //Create an instance of SqlAzManStorage class
    IAzManStorage storage = new SqlAzManStorage(sqlConnectionString);
    //Open Storage Connection
    storage.OpenConnection();
    //Begin a new Transaction
    storage.BeginTransaction(AzManIsolationLevel.ReadUncommitted);
    //Create a new Store
    IAzManStore newStore = storage.CreateStore("My Store", "Store description");
    //Create a new Basic StoreGroup
    IAzManStoreGroup newStoreGroup = newStore.CreateStoreGroup(SqlAzManSID.NewSqlAzManSid(), "My Store Group", "Store Group Description", String.Empty, GroupType.Basic);
    //Retrieve current user SID
    IAzManSid mySid = new SqlAzManSID(WindowsIdentity.GetCurrent().User);
    //Add myself as sid of "My Store Group"
    IAzManStoreGroupMember storeGroupMember = newStoreGroup.CreateStoreGroupMember(mySid, WhereDefined.Local, true);
    //Create a new Application
    IAzManApplication newApp = newStore.CreateApplication("New Application", "Application description");
    //Create a new Role
    IAzManItem newRole = newApp.CreateItem("New Role", "Role description", ItemType.Role);
    //Create a new Task
    IAzManItem newTask = newApp.CreateItem("New Task", "Task description", ItemType.Task);
    //Create a new Operation
    IAzManItem newOp = newApp.CreateItem("New Operation", "Operation description", ItemType.Operation);
    //Add "New Operation" as a sid of "New Task"
    newTask.AddMember(newOp);
    //Add "New Task" as a sid of "New Role"
    newRole.AddMember(newTask);
    //Create an authorization for myself on "New Role"
    IAzManAuthorization auth = newRole.CreateAuthorization(mySid, WhereDefined.Local, mySid, WhereDefined.Local, AuthorizationType.AllowWithDelegation, null, null);
    //Create a custom attribute
    IAzManAttribute<IAzManAuthorization> attr = auth.CreateAttribute("New Key", "New Value");
    //Create an authorization for DB User "Andrea" on "New Role"
    IAzManAuthorization auth2 = newRole.CreateAuthorization(mySid, WhereDefined.Local, storage.GetDBUser("Andrea").CustomSid, WhereDefined.Local, AuthorizationType.AllowWithDelegation, null, null);
    //Commit transaction
    storage.CommitTransaction();
    //Close connection
    storage.CloseConnection();
}

这本身就是一个故事。

关于c# - NetSqlAzMan vs AzMan vs (?????)，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/8750367/