如何在.Net中實現安全性？

Question

我有一個對象的安全描述符。我想要使​​用該安全描述符讓用戶和組擁有該對象的權限。如何知道哪些用戶擁有使用該安全描述符的權限？是否有可能使用ObjectSecurity或CommonObjectSecurity抽象類？如果是的話如何定義訪問規則？有沒有任何工作樣本？

Answer 1

要使用它們的權限訪問用戶和組，在.Net中我們有一個簡單的機制。實現CommonObjectSecurity類，它是一個抽象類，並覆蓋AccessRuleFactory和AuditRuleFactory方法，並覆蓋屬性AccessRuleType和AuditRuleType。在以下示例中，SampleSecurity類是從CommonObjectSecurity派生的。我們還從AccessRule中定義了SampleAccessRule類。我們可以選擇實現AddAccessRule和RemoveAccessRule來修改安全性。

public class SampleSecurity : CommonObjectSecurity 
{ 
    public SampleSecurity(bool isContainer) 
     : base(isContainer) 
    { 
    } 

    public override AccessRule AccessRuleFactory(IdentityReference identityReference, 
     int accessMask, bool isInherited, InheritanceFlags inheritanceFlags, 
     PropagationFlags propagationFlags, AccessControlType type) 
    { 
     return new SampleAccessRule(identityReference, accessMask, type); 
    } 

    public void AddAccessRule(IdentityReference identityReference, 
     int accessMask, AccessControlType type) 
    { 
     base.AddAccessRule(new ProxyAccessRule(identityReference, accessMask, type)); 
    } 

    public void RemoveAccessRule(ProxyAccessRule rule) 
    { 
     base.RemoveAccessRule(rule); 
    } 

    public override Type AccessRuleType 
    { 
     get { return typeof(ProxyAccessRule); } 
    } 

    public override AuditRule AuditRuleFactory(System.Security.Principal.IdentityReference identityReference, int accessMask, bool isInherited, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags, AuditFlags flags) 
    { 
     throw new NotImplementedException(); 
    } 

    public override Type AuditRuleType 
    { 
     get { throw new NotImplementedException(); } 
    } 

      public override Type AccessRightType 
    { 
     get { return typeof(SampleRightsEnum); } 
    } 
} 

public class SampleAccessRule : AccessRule 
{ 
    public ProxyAccessRule(IdentityReference identity, int accessMask, AccessControlType accessType) 
     : base(identity, accessMask, false, InheritanceFlags.None, PropagationFlags.None, accessType) 
    { 
    } 

    public int AccessRights { get { return AccessMask; } } 
} 

    public enum SampleRightsEnum 
{ 
    sampleRead = 0x001, 
    sampleWrite = 0x002, 
    sampleExecute = 0x004 
} 

一旦這樣定義，我們可以創建SampleSecurity的一個對象，並給它分配的安全描述符，從該如下所列我們可以讀取的權限爲不同的用戶。

SampleSecurity security = new SampleSecurity(false); 
      security.SetSecurityDescriptorBinaryForm((byte[])securityDescriptor, AccessControlSections.All); 
      AuthorizationRuleCollection coll = dataSecurity.GetAccessRules(true, false, typeof(NTAccount)); 
      foreach (AuthorizationRule rule in coll) 
      { 
       SampleAccessRule accRule = rule as SampleAccessRule; 
       SampleRightsEnum rights = (SampleRightsEnum)accRule.AccessRights; 
       Console.Writeline("User or Group {0} having the permissions {1} with access type {2}", rule.IdentityReference.Value, rights.ToString(), accRule.AccessControlType.ToString()); 
      }