授权数据库模型

Question

作为 JSF/JPA Web 应用程序项目的一部分，我需要实现一个完整的用户授权模块。我正在使用 Apache Shiro 进行身份验证，如果它符合要求，也可以将其用于授权。但是，现在我正在设计数据库模式模型并提出了下表。我不确定这是否是最好的方法并且需要一些反馈。

要求

根据用户的角色和组成员身份对用户进行授权。角色可以分配给组或个人用户。数据分散在多个表中，但这里我将仅举一个存储项目详细信息的表的示例。

授权表列表

Table:APP_USER : This table will store the user details along with hashed password
Columns: ID/Username/Password

Table:APP_ROLES : This table stores the roles definitions
Columns:ID/Rolename/Desc

Table: APP_PRIVILEGES : This table stores the actual privileges that are assigned to roles
Columns: ID/Privilege Name/Privilege Type/Role ID

Table: APP_GROUPS: This table stores the group definitions
Columns: ID/GroupName/

Table: APP_USER_GROUPS_MAPPING: This table stores mapping of users to groups and has references to APP_USERS & APP_Groups tables
Columns: USER_ID/Group ID

Table: APP_GROUP_ROLES_MAPPING: This table stores the mapping of groups to roles and has references to APP_ROLES and APP_GROUPS
Columns: Group_ID/Role_ID


Table: APP_USER_ROLE_MAPPING: This table stores the mapping of users to roles in case the role is directly assigned to users and has references to APP_USERS and APP_ROLES tables
Columns: USER_ID/ROLE_ID

Table: APP_PROJECTS_DETAILS: This is one of the many tables that store the data. This specific table holds project details
Columns: ID/PROJECT_NAME/DESC etc

Table: APP_GROUP_PROJECTS_MAPPING: This table stores the permission mapping of which groups has access to which projects.

授权示例：用户尝试删除项目 Test1

---

1. 从 APP_GROUP_PROJECTS_MAPPING 检索项目 Test1 的项目/组映射
2. 从 APP_USER_GROUPS_MAPPING 检索用户组
3. 检查是否有任何用户组有权访问项目 Test1
4. 假设用户有权限，通过分别查询APP_USER_ROLE_MAPPING和APP_GROUP_ROLES_MAPPING检查用户是否直接或通过组有DELETE_PROJECT权限
5. 删除项目Test1

我个人觉得这有点复杂，但不确定如何改进

Answer 1

听起来是个不错的设计，但您可能需要重新发明轮子。 Java EE already provides both declarative and programmatic security facilities 与您尝试实现的类似。

Answer 2

## Prepare your database relation like this  ##

用户----

@OneToMany(mappedBy = "User")
@XmlTransient
private List<GroupPermissions> groupPermissionsList;

@ManyToOne
@JoinColumn(name = "roleId", referencedColumnName = "id", insertable = false, updatable = false)
@XmlTransient
private Role role;
private static final long serialVersionUID = 5667633010066722654L;

组权限

private int userId;
private int groupId;

@ManyToOne
@JoinColumn(name = "userId", referencedColumnName = "id", insertable = false, updatable = false)
@XmlTransient
private User user;

@ManyToOne
@JoinColumn(name = "groupId", referencedColumnName = "id", insertable = false, updatable = false)
@XmlTransient
private ProjectGroup group;

项目组权限

private int groupId;
private int projectId;

@ManyToOne
@JoinColumn(name = "groupId", referencedColumnName = "id", insertable = false, updatable = false)
@XmlTransient
private ProjectGroup projectGroup;

@ManyToOne
@JoinColumn(name = "projectId", referencedColumnName = "id", insertable = false, updatable = false)
@XmlTransient
private Project project; 

角色

  Define your filed in rile table

执行这些步骤

在加载方法中查看项目页面

1 如果有角色，则检索用户分配角色 ex（删除、修改、查看）（第 1 步） 而不是在未经授权的访问上检查第二步其他明智的重定向 2 首先检索用户分配组--->项目