Design of Windows Authentication and permission management

Design Scheme

• Use LDAP for user login authentication and read the role in the user domain.
• You can use the associated table of user roles and permissions to determine whether a user can access an operation page. If the user cannot perform the operation, the system prompts that the user has no relevant permissions and provides a return portal.
• Records all user security logs and operation logs (including, add, modify, delete, and query logs)

Function

• Role-function-permission management interface
• Function List Management
• Function module Management
• Event Log Management

Database backend_authorize

• Function_list: function ID, function name, function introduction, parent function ID, function URL, and availability
• Permission table (permission): Permission ID, permission name
• Role permission table (role_authorized): Role permission ID, role name, User Position, function ID, permission ID
• Event Log table (event_log): ID, user name, Client IP address, event type, function name, Module name, detailed description, Operation Time

Scenario

* Verify the logic. jpg:

Note: users' positions are stored in the description column of the domain users. However, the user's description is blank in the current domain environment, so user description judgment is not performed for the moment, that is, the user's role can access the page, that is, the authentication of permissions.

Data rules

Table
Field
Data rules and conventions

Function_list
Fucntion_list_id
Auto-increment, primary key

Name
Function Name

Description
Function Description

Parent_id
Parent function number. The default value is 0, indicating the basic function.

URL
Function URL, storage rule: Value of request. url. absolutepath

Is_valid
Whether the function is available. The default value is 0 and the value is 1.

Permission
Permission_id
Auto-increment, primary key

Name
Permission name (full control, read-only)

Role_authorized
Role_authorized_id
Auto-increment, primary key

Role_name
User Role, storage rule: Save As the group name in the domain

User_description
User's position, storage rules: saved as the description of the user in the domain. If the description contains multiple positions (Leader, employee...), insert only one position in this field and store multiple records.

Function_id
Authorized function ID

Permission_id
Authorize the user's access permissions (full control, read-only (later ))

Application

• New Feature
  • In the data table function_list, add

• Allocate accessible role information for features
  • In the role_authorized table, add

• Web applications
  • after the function page is developed, to add access control, drag and drop the user permission verification control (project \ backofficeweb \ windowsauthorized \ webusercontrol. ascx is available on the page, without the need for other Code