NetSqlAzMan vs AzMan vs (??????)

我一直在尝试“从字里行间解读”NetSqlAzMan 项目的原始（和/或当前）动机。

这是写的吗？

1. Windows 授权管理器 (AzMan) 的适配器。 NetSqlAzMan 中的方法只是将调用传递给（Windows 授权管理器（AzMan）），但可能使用更好/更干净的方法？

2. (Windows 授权管理器 (AzMan)) 的替代品。其中（大部分或全部）（Windows 授权管理器 (AzMan)）中可用的功能在 NetSqlAzMan 中重新创建，但代码是独立开发的。 （也许提供 DotNet 4.0 支持？？？）（也许删除任何 COM 依赖项）

3. 提供比（Windows 授权管理器 (AzMan)）提供的更多功能。又称（Windows 授权管理器 (AzMan)）的“更智能”/“更好”版本。

4. 重写但也通过开源让一个半死的项目保持活力。 （例如，也许（Windows 授权管理器（AzMan）））是 Microsoft 已死亡或放弃的项目）。

5. Other?

......................

我喜欢 NetSqlAzMan 的对象模型。但我需要向我的项目经理和其他开发人员捍卫任何使用它的决定。 对象模型看起来“恰到好处”（想想金发姑娘 http://www.pmcgee.net/prodesign/goldilocks_large.jpg和中间的床）就我所希望的安全而言。 我不想做基于角色的安全。我想要基于权利（或任务或权限）的安全性。

(See: http://lostechies.com/derickbailey/2011/05/24/dont-do-role-based-authorization-checks-do-activity-based-checks/ http://lostechies.com/derickbailey/2011/05/24/dont-do-role-based-authorization-checks-do-activity-based-checks/ and http://granadacoder.wordpress.com/2010/12/01/rant-hard-coded-security-roles/ http://granadacoder.wordpress.com/2010/12/01/rant-hard-coded-security-roles/ )

基本上出现的问题是：“使用 NetSqlAzMan 代替（Windows 授权管理器 (AzMan)）有什么优势？”

子问题是“Windows 授权管理器 (AzMan) 死了吗？”。 （还有类似于 NetSqlAzMan 万岁的内容！）。

......................

我的总体要求是：

非 Active-Directory 用户。 （以后 Active Directory 和/或 LDAP 支持会很好，但不是必需的）。 密码不以纯文本形式存储。 能够处理安全检查的权利。
将权利分组到任何角色下。 为用户分配角色。 （但同样，执行操作时代码将检查权限，而不是角色。） 允许（有时）将权限分配给用户。具有拒绝覆盖。 （也就是说，如果单个用户做了愚蠢的事情（例如“删除员工”），该权利可能会被撤销。） 可以为多个应用程序维护角色和权限。

所以欢迎其他想法。但Windows 身份基础 http://blogs.msdn.com/b/card/archive/2009/10/20/how-geneva-helps-with-access-control-and-what-is-its-relationship-to-azman.aspx似乎有点矫枉过正。

Thanks.

昨晚终于找到了一篇“比较”的文章。

http://www.c-sharpcorner.com/uploadfile/a.ferendeles/netsqlazman12122006123316pm/netsqlazman.aspx http://www.c-sharpcorner.com/uploadfile/a.ferendeles/netsqlazman12122006123316pm/netsqlazman.aspx

我将把相关部分粘贴在这里（如下）。 （以防万一该网站将来不再存在。我知道可能性很小，但我讨厌“答案就在这里”链接，当你点击该链接时，它就死了。）

据我所知。

NetSqlAzMan 提供了一个（表）用户定义函数，您可以重载该函数以提供用户列表（要分配给角色/任务）。 NetSqlAzMan 不仅提供“是的，你可以”映射 (Grant)，还提供 Deny 和 Grant-With-Delegate。 NetSqlAzMan 和 Azman 允许用户（组）进行角色映射。只有 NetSqlAzMan 允许用户进行任务映射。

在查看了几个示例之后...NetSqlAzMan 的对象模型非常干净。

=================================================== =====

Ms 授权管理器 (AzMan) 与 .NET Sql 授权管理器 （NetSqlAzMan）

正如之前指出的，类似的微软产品已经存在 称为授权管理器（AzMan）；阿兹曼出席，由 默认情况下，在 Windows Server 2003 中，并且通过 Admin Pack 设置，在 Windows XP。

AzMan 和 NetSqlAzMan 之间的重要区别在于 首先是Role-based，即基于归属-Role的概念 以及每个角色中的操作容器，而第二个是 基于项目（或者如果您更喜欢基于操作），即用户或用户 可以或不可以属于角色或执行的组或组 此类任务和/或操作（项目）。

这是两者之间最重要的特征和区别 产品：

阿兹曼女士：

* It's COM.
* It's equipped by a MMC 2.0 (COM) console.
* Its storage can be an XML file or ADAM (Active Directory Application Mode - e un LDAP).
* It's role-based.
* It supports static/dynamic applicative groups, members/not-members.
* Structure based on Roles -> Tasks -> Operations. (Hierarchical Roles and Tasks , none Operations).
* Authorizations can be added only to Roles.
* It doesn't implement the "delegate" concept.
* It doesn't manage authorizations "in the time".
* It doesn't trigger events.
* The only type of authorization is "Allow".
  (to "deny" it needs to remove the user/group from his Role).
* It supports Scripting / Biz rules.
* It supports Active Directory users/groups and ADAM users.

NetSqlAzMan：

* It's .NET 2.0.
* It's equipped by a MMC 3.0 (.NET) console.
* Its storage is a Sql Server database(2000/MSDE/2005/Express).
* It's based on Tdo - Typed Data Object technology.
* It's Item-based.
* Structure based on Roles -> Tasks -> Operations. (all hierarchical ones).
* Authorizations can be added to Roles, Task and Operations.
* It supports static/dynamic applicative groups, members/not-members.
* LDAP query testing directly from console.
* It's time-dependant.
* It's delegate-compliant.
* It triggers events (ENS).
* It supports 4 authorization types:
      o Allow with delegation (authorized and authorized to delegate).
      o Allow (authorized).
      o Deny (not authorized).
      o Neutral (neutral permission, it depends on higher level Item permission).
* Hierarchical authorizations.
* It supports Scripting / Biz rules (compiled in .NET - C# - VB - and not interpreted)
* It supports Active Directory users/groups and custom users defined in SQL Server Database.

这是另一个问题。

阿兹曼示例代码：http://channel9.msdn.com/forums/sandbox/252978-AzMan-in-the-Enterprise-Sample-Code http://channel9.msdn.com/forums/sandbox/252978-AzMan-in-the-Enterprise-Sample-Code http://channel9.msdn.com/forums/sandbox/252973-Programming-AzMan-Sample-Code http://channel9.msdn.com/forums/sandbox/252973-Programming-AzMan-Sample-Code

using System;
using System.Security.Principal;
using System.Runtime.InteropServices;
using AZROLESLib;

namespace TreyResearch {
    public class AzManHelper : IDisposable {

        AzAuthorizationStore store;
        IAzApplication app;
        string appName;

        public AzManHelper(string connectionString, string appName) {

            this.appName = appName;

            try {
                // load and initialize the AzMan runtime
                store = new AzAuthorizationStore();
                store.Initialize(0, connectionString, null);

                // drill down to our application
                app = store.OpenApplication(appName, null);
            }
            catch (COMException x) {
                throw new AzManException("Failed to initizlize AzManHelper", x);
            }
            catch (System.IO.FileNotFoundException x) {
                throw new AzManException(string.Format("Failed to load AzMan policy from {0} - make sure your connection string is correct.", connectionString), x);
            }
        }

        public void Dispose() {
            if (null == app) return;

            Marshal.ReleaseComObject(app);
            Marshal.ReleaseComObject(store);

            app = null;
            store = null;
        }

        public bool AccessCheck(string audit, Operations op,
                                WindowsIdentity clientIdentity) {

            try {
                // first step is to create an AzMan context for the client
                // this looks at the security identifiers (SIDs) in the user's
                // access token and maps them onto AzMan roles, tasks, and operations
                IAzClientContext ctx = app.InitializeClientContextFromToken(
                    (ulong)clientIdentity.Token.ToInt64(), null);

                // next step is to see if this user is authorized for
                // the requested operation. Note that AccessCheck allows
                // you to check multiple operations at once if you desire
                object[] scopes = { "" };
                object[] operations = { (int)op };
                object[] results = (object[])ctx.AccessCheck(audit, scopes, operations,
                                                             null, null, null, null, null);
                int result = (int)results[0];
                return 0 == result;
            }
            catch (COMException x) {
                throw new AzManException("AccessCheck failed", x);
            }
        }

        public bool AccessCheckWithArg(string audit, Operations op,
                                       WindowsIdentity clientIdentity,
                                       string argName, object argValue) {

            try {
                // first step is to create an AzMan context for the client
                // this looks at the security identifiers (SIDs) in the user's
                // access token and maps them onto AzMan roles, tasks, and operations
                IAzClientContext ctx = app.InitializeClientContextFromToken(
                    (ulong)clientIdentity.Token.ToInt64(), null);

                // next step is to see if this user is authorized for
                // the requested operation. Note that AccessCheck allows
                // you to check multiple operations at once if you desire
                object[] scopes = { "" };
                object[] operations = { (int)op };
                object[] argNames = { argName };
                object[] argValues = { argValue };
                object[] results = (object[])ctx.AccessCheck(audit, scopes, operations,
                                                             argNames, argValues,
                                                             null, null, null);
                int result = (int)results[0];
                return 0 == result;
            }
            catch (COMException x) {
                throw new AzManException("AccessCheckWithArg failed", x);
            }
        }

        // use this to update a running app
        // after you change the AzMan policy
        public void UpdateCache() {
            try {
                store.UpdateCache(null);
                Marshal.ReleaseComObject(app);
                app = store.OpenApplication(appName, null);
            }
            catch (COMException x) {
                throw new AzManException("UpdateCache failed", x);
            }
        }
    }

    public class AzManException : Exception {
        public AzManException(string message, Exception innerException)
          : base(message, innerException)
        {}
    }
}

这是 Azman 辅助代码。那是丑陋的 COM/Interopish 东西。 :

现在检查 NetSqlAzMan 代码示例：

http://netsqlazman.codeplex.com/wikipage?title=样本 http://netsqlazman.codeplex.com/wikipage?title=Samples

/// <summary>
/// Create a Full Storage through .NET code
/// </summary>
private void CreateFullStorage()
{
    // USER MUST BE A MEMBER OF SQL DATABASE ROLE: NetSqlAzMan_Administrators

    //Sql Storage connection string
    string sqlConnectionString = "data source=(local);initial catalog=NetSqlAzManStorage;user id=netsqlazmanuser;password=password";
    //Create an instance of SqlAzManStorage class
    IAzManStorage storage = new SqlAzManStorage(sqlConnectionString);
    //Open Storage Connection
    storage.OpenConnection();
    //Begin a new Transaction
    storage.BeginTransaction(AzManIsolationLevel.ReadUncommitted);
    //Create a new Store
    IAzManStore newStore = storage.CreateStore("My Store", "Store description");
    //Create a new Basic StoreGroup
    IAzManStoreGroup newStoreGroup = newStore.CreateStoreGroup(SqlAzManSID.NewSqlAzManSid(), "My Store Group", "Store Group Description", String.Empty, GroupType.Basic);
    //Retrieve current user SID
    IAzManSid mySid = new SqlAzManSID(WindowsIdentity.GetCurrent().User);
    //Add myself as sid of "My Store Group"
    IAzManStoreGroupMember storeGroupMember = newStoreGroup.CreateStoreGroupMember(mySid, WhereDefined.Local, true);
    //Create a new Application
    IAzManApplication newApp = newStore.CreateApplication("New Application", "Application description");
    //Create a new Role
    IAzManItem newRole = newApp.CreateItem("New Role", "Role description", ItemType.Role);
    //Create a new Task
    IAzManItem newTask = newApp.CreateItem("New Task", "Task description", ItemType.Task);
    //Create a new Operation
    IAzManItem newOp = newApp.CreateItem("New Operation", "Operation description", ItemType.Operation);
    //Add "New Operation" as a sid of "New Task"
    newTask.AddMember(newOp);
    //Add "New Task" as a sid of "New Role"
    newRole.AddMember(newTask);
    //Create an authorization for myself on "New Role"
    IAzManAuthorization auth = newRole.CreateAuthorization(mySid, WhereDefined.Local, mySid, WhereDefined.Local, AuthorizationType.AllowWithDelegation, null, null);
    //Create a custom attribute
    IAzManAttribute<IAzManAuthorization> attr = auth.CreateAttribute("New Key", "New Value");
    //Create an authorization for DB User "Andrea" on "New Role"
    IAzManAuthorization auth2 = newRole.CreateAuthorization(mySid, WhereDefined.Local, storage.GetDBUser("Andrea").CustomSid, WhereDefined.Local, AuthorizationType.AllowWithDelegation, null, null);
    //Commit transaction
    storage.CommitTransaction();
    //Close connection
    storage.CloseConnection();
}

这本身就是一个故事。