NetSqlAzMan与AzMan相比有何不同？(?????)

Question

我一直在试图“读懂”NetSqlAzMan项目最初（和/或当前）的动机。

这个项目是为了什么写的？

1.作为Windows授权管理器（AzMan）的适配器。NetSqlAzMan中的方法只是将调用传递到Windows授权管理器（AzMan），但可能使用更好/更清晰的方法？

2.作为Windows授权管理器（AzMan）的替代品。NetSqlAzMan中提供了大多数或所有可在Windows授权管理器（AzMan）中使用的功能，但该代码是独立开发的。（也许是为了提供DotNet 4.0支持？）（也许是为了消除任何COM依赖关系）

3.提供比Windows授权管理器（AzMan）更多的功能。即“更聪明”/“更好”的版本的Windows授权管理器（AzMan）。

4.通过开源重写但也保留半死不活的项目。 （例如，也许Microsoft已经停止开发Windows授权管理器（AzMan））。

5.其他？

................

我喜欢NetSqlAzMan的对象模型。但是我需要向我的项目经理和其他开发人员证明使用它的决定是正确的。就我所期望的安全性而言，对象模型似乎“刚刚好”（想象goldilocks和中间的床）。我不想要基于角色的安全性，我想要基于权限（或任务或许可）的安全性。

（参见： http://lostechies.com/derickbailey/2011/05/24/dont-do-role-based-authorization-checks-do-activity-based-checks/ 和 http://granadacoder.wordpress.com/2010/12/01/rant-hard-coded-security-roles/ ）

基本上，出现的问题是：“与Windows授权管理器（AzMan）相比，使用NetSqlAzMan的优势是什么？”

而子问题是“Windows授权管理器（AzMan）是否已经过时？”（以及类似于Long Live NetSqlAzMan！的东西）。

..................

我的一般要求是：

非Active Directory用户。(未来支持Active Directory和/或LDAP将会很好，但不是必需的)。 密码不以明文形式存储。 能够处理安全检查的权限。
将权限分组到任何角色下。 为用户分配角色。(但是在执行操作时，代码将检查权限而不是角色。) 允许(偶尔)向用户分配权限。带有拒绝覆盖。(例如，一个单独的用户做了愚蠢的事情(比如“删除员工”)，可以撤销该权限。) 角色和权限可以维护多个应用程序。

所以其他想法也是受欢迎的。但是Windows Identity Foundation似乎有点过度了。

谢谢。

- granadaCoder

Answer 1

我昨晚终于找到了一篇“比较”文章。

http://www.c-sharpcorner.com/uploadfile/a.ferendeles/netsqlazman12122006123316pm/netsqlazman.aspx

我将在此处粘贴相关部分（下面）。 （以防该网站将来停止存在。我知道几率很小，但我讨厌“答案在这里”链接，当您点击链接时，它是一个死链接。）

据我所知。

NetSqlAzMan提供了一个（表）用户定义的函数，您可以重载以提供用户列表（分配给角色/任务）。 NetSqlAzMan不仅提供“是的，您可以”映射（授予权限），还提供拒绝和授权委派。 NetSqlAzMan和Azman允许用户（组）与角色的映射。只有NetSqlAzMan允许用户与任务的映射。

在查看了一些示例后... NetSqlAzMan的对象模型非常干净。

=======================================================

Ms Authorization Manager (AzMan) vs .NET Sql Authorization Manager (NetSqlAzMan)

As pointed out before, an analogous Microsoft product already exists and is called Authorization Manager (AzMan); AzMan is present, by default, in Windows Server 2003 and, through the Admin Pack setup, in Windows XP.

The important difference between AzMan and NetSqlAzMan is that the first is Role-based, that is, based on the belonging - Role concept and the operations container in each role, while the second is Item-based (or if you prefer Operation-based), that is users or users group or group of groups that can or cannot belong to Roles or execute such Task and/or Operations (Items).

Here the most important features and differences between the two products:

Ms AzMan:

* It's COM.
* It's equipped by a MMC 2.0 (COM) console.
* Its storage can be an XML file or ADAM (Active Directory Application Mode - e un LDAP).
* It's role-based.
* It supports static/dynamic applicative groups, members/not-members.
* Structure based on Roles -> Tasks -> Operations. (Hierarchical Roles and Tasks , none Operations).
* Authorizations can be added only to Roles.
* It doesn't implement the "delegate" concept.
* It doesn't manage authorizations "in the time".
* It doesn't trigger events.
* The only type of authorization is "Allow".
  (to "deny" it needs to remove the user/group from his Role).
* It supports Scripting / Biz rules.
* It supports Active Directory users/groups and ADAM users.

NetSqlAzMan:

* It's .NET 2.0.
* It's equipped by a MMC 3.0 (.NET) console.
* Its storage is a Sql Server database(2000/MSDE/2005/Express).
* It's based on Tdo - Typed Data Object technology.
* It's Item-based.
* Structure based on Roles -> Tasks -> Operations. (all hierarchical ones).
* Authorizations can be added to Roles, Task and Operations.
* It supports static/dynamic applicative groups, members/not-members.
* LDAP query testing directly from console.
* It's time-dependant.
* It's delegate-compliant.
* It triggers events (ENS).
* It supports 4 authorization types:
      o Allow with delegation (authorized and authorized to delegate).
      o Allow (authorized).
      o Deny (not authorized).
      o Neutral (neutral permission, it depends on higher level Item permission).
* Hierarchical authorizations.
* It supports Scripting / Biz rules (compiled in .NET - C# - VB - and not interpreted)
* It supports Active Directory users/groups and custom users defined in SQL Server Database.

这里有一个需要注意的地方。

Azman示例代码： http://channel9.msdn.com/forums/sandbox/252978-AzMan-in-the-Enterprise-Sample-Code http://channel9.msdn.com/forums/sandbox/252973-Programming-AzMan-Sample-Code

using System;
using System.Security.Principal;
using System.Runtime.InteropServices;
using AZROLESLib;

namespace TreyResearch {
    public class AzManHelper : IDisposable {

        AzAuthorizationStore store;
        IAzApplication app;
        string appName;

        public AzManHelper(string connectionString, string appName) {

            this.appName = appName;

            try {
                // load and initialize the AzMan runtime
                store = new AzAuthorizationStore();
                store.Initialize(0, connectionString, null);

                // drill down to our application
                app = store.OpenApplication(appName, null);
            }
            catch (COMException x) {
                throw new AzManException("Failed to initizlize AzManHelper", x);
            }
            catch (System.IO.FileNotFoundException x) {
                throw new AzManException(string.Format("Failed to load AzMan policy from {0} - make sure your connection string is correct.", connectionString), x);
            }
        }

        public void Dispose() {
            if (null == app) return;

            Marshal.ReleaseComObject(app);
            Marshal.ReleaseComObject(store);

            app = null;
            store = null;
        }

        public bool AccessCheck(string audit, Operations op,
                                WindowsIdentity clientIdentity) {

            try {
                // first step is to create an AzMan context for the client
                // this looks at the security identifiers (SIDs) in the user's
                // access token and maps them onto AzMan roles, tasks, and operations
                IAzClientContext ctx = app.InitializeClientContextFromToken(
                    (ulong)clientIdentity.Token.ToInt64(), null);

                // next step is to see if this user is authorized for
                // the requested operation. Note that AccessCheck allows
                // you to check multiple operations at once if you desire
                object[] scopes = { "" };
                object[] operations = { (int)op };
                object[] results = (object[])ctx.AccessCheck(audit, scopes, operations,
                                                             null, null, null, null, null);
                int result = (int)results[0];
                return 0 == result;
            }
            catch (COMException x) {
                throw new AzManException("AccessCheck failed", x);
            }
        }

        public bool AccessCheckWithArg(string audit, Operations op,
                                       WindowsIdentity clientIdentity,
                                       string argName, object argValue) {

            try {
                // first step is to create an AzMan context for the client
                // this looks at the security identifiers (SIDs) in the user's
                // access token and maps them onto AzMan roles, tasks, and operations
                IAzClientContext ctx = app.InitializeClientContextFromToken(
                    (ulong)clientIdentity.Token.ToInt64(), null);

                // next step is to see if this user is authorized for
                // the requested operation. Note that AccessCheck allows
                // you to check multiple operations at once if you desire
                object[] scopes = { "" };
                object[] operations = { (int)op };
                object[] argNames = { argName };
                object[] argValues = { argValue };
                object[] results = (object[])ctx.AccessCheck(audit, scopes, operations,
                                                             argNames, argValues,
                                                             null, null, null);
                int result = (int)results[0];
                return 0 == result;
            }
            catch (COMException x) {
                throw new AzManException("AccessCheckWithArg failed", x);
            }
        }

        // use this to update a running app
        // after you change the AzMan policy
        public void UpdateCache() {
            try {
                store.UpdateCache(null);
                Marshal.ReleaseComObject(app);
                app = store.OpenApplication(appName, null);
            }
            catch (COMException x) {
                throw new AzManException("UpdateCache failed", x);
            }
        }
    }

    public class AzManException : Exception {
        public AzManException(string message, Exception innerException)
          : base(message, innerException)
        {}
    }
}

这是Azman助手代码。那是丑陋的COM/Interopish材料。 :<

现在检查NetSqlAzMan代码示例：

http://netsqlazman.codeplex.com/wikipage?title=Samples

/// <summary>
/// Create a Full Storage through .NET code
/// </summary>
private void CreateFullStorage()
{
    // USER MUST BE A MEMBER OF SQL DATABASE ROLE: NetSqlAzMan_Administrators

    //Sql Storage connection string
    string sqlConnectionString = "data source=(local);initial catalog=NetSqlAzManStorage;user id=netsqlazmanuser;password=password";
    //Create an instance of SqlAzManStorage class
    IAzManStorage storage = new SqlAzManStorage(sqlConnectionString);
    //Open Storage Connection
    storage.OpenConnection();
    //Begin a new Transaction
    storage.BeginTransaction(AzManIsolationLevel.ReadUncommitted);
    //Create a new Store
    IAzManStore newStore = storage.CreateStore("My Store", "Store description");
    //Create a new Basic StoreGroup
    IAzManStoreGroup newStoreGroup = newStore.CreateStoreGroup(SqlAzManSID.NewSqlAzManSid(), "My Store Group", "Store Group Description", String.Empty, GroupType.Basic);
    //Retrieve current user SID
    IAzManSid mySid = new SqlAzManSID(WindowsIdentity.GetCurrent().User);
    //Add myself as sid of "My Store Group"
    IAzManStoreGroupMember storeGroupMember = newStoreGroup.CreateStoreGroupMember(mySid, WhereDefined.Local, true);
    //Create a new Application
    IAzManApplication newApp = newStore.CreateApplication("New Application", "Application description");
    //Create a new Role
    IAzManItem newRole = newApp.CreateItem("New Role", "Role description", ItemType.Role);
    //Create a new Task
    IAzManItem newTask = newApp.CreateItem("New Task", "Task description", ItemType.Task);
    //Create a new Operation
    IAzManItem newOp = newApp.CreateItem("New Operation", "Operation description", ItemType.Operation);
    //Add "New Operation" as a sid of "New Task"
    newTask.AddMember(newOp);
    //Add "New Task" as a sid of "New Role"
    newRole.AddMember(newTask);
    //Create an authorization for myself on "New Role"
    IAzManAuthorization auth = newRole.CreateAuthorization(mySid, WhereDefined.Local, mySid, WhereDefined.Local, AuthorizationType.AllowWithDelegation, null, null);
    //Create a custom attribute
    IAzManAttribute<IAzManAuthorization> attr = auth.CreateAttribute("New Key", "New Value");
    //Create an authorization for DB User "Andrea" on "New Role"
    IAzManAuthorization auth2 = newRole.CreateAuthorization(mySid, WhereDefined.Local, storage.GetDBUser("Andrea").CustomSid, WhereDefined.Local, AuthorizationType.AllowWithDelegation, null, null);
    //Commit transaction
    storage.CommitTransaction();
    //Close connection
    storage.CloseConnection();
}

那本身已经讲述了一个故事。

- granadaCoder

---

我只是想指出，关于Azman的文章和观点是来自于2006年发布的文章。当Windows Server 2008发布时，Azman得到了更新和改进（特别是API和SQL Server Store支持）。但似乎Azman已经被放弃了。最后一篇Azman团队博客更新是在2008年。 - Haydar

谢谢你的建议。不要过多地依赖Azman，因为它与特定的操作系统版本相关联......这对我来说也是一个麻烦的地方。但它可能是一些更好东西的灵感来源之一.... - granadaCoder

NETSQL Azman 是否与 Windows Azman 有依赖关系？由于 Azman 在未来的 Windows 版本中可能被弃用，这是否意味着 NETSQL Azman 在那时将无法使用？ - Donald N. Mafa

Answer 2

我认为微软博客和SDK缺乏更新的原因与他们已经将所有工具和设计转向社交网络/联邦友好的“声明模型”有关。

http://msdn.microsoft.com/en-us/magazine/ee335707.aspx

与AzMan的任何变体相比，在低级别的AzMan操作水平上（代码要求将其与其他部分解耦），我们只有一种权限类型声明。这种新的操作方式只是一个URN字符串/动作名称，由任何可信赖的声明提供者/服务发出，并通过您（或稍后重新配置）定义的签名进行验证。然后它们只是用户身份中的角色列表，因此可以使用常见的IsInRole方法轻松检查。

这样做的理由很清楚。现代互联网解决方案（以及也许是一些未来的公司内部网络应用程序，一旦隐私法规得到改善）需要多域身份验证和授权，例如此StackOverflow.com用户帐户和连接的Facebook帐户或您可能已链接的任何OpenID帐户。

因此，对于授权，您现在可以编写规则，将外部声明与内部“权限声明”（类似于AzMan操作）之间进行映射。但是，没有标准的格式、层次结构或管理工具。

也许Claims服务（身份验证）+ AzMan XML / SQL（角色到声明的映射）+ Claims权限需求的混合解决方案是前进的方法。到目前为止，我找到的所有示例都只有中间的代码。我想看到一些递归组成员从Active Directory解析为Roles到Tasks到claims（操作），就像我们已经使用AzMan一样。

需要进行更多的调查，以利用新技术实现“基于角色的安全”模式，这仍然是至关重要的。如果您想要开始，请前往 Microsoft Windows Identity Foundation（WIF），它首次出现在 .NET 3.5.1 中，但现已集成到 .NET 4.5 框架中。

http://msdn.microsoft.com/en-us/library/hh377151(v=vs.110).aspx

- Tony Wall

---

对于未来的读者...我已完全放弃了“老派”的做法，现在使用声明授权。虽然需要克服一些小障碍，但最终效果不错。 - granadaCoder