NetSqlAzMan vs AzMan vs (?????)

昨晚我终于找到了一篇"比较"文章。

http://www.c-sharpcorner.com/uploadfile/a.ferendeles/netsqlazman12122006123316pm/netsqlazman.aspx

我将把相关部分粘贴在这里（如下）。（以防该网站在未来不复存在。我知道，可能性很小，但我讨厌"答案在这里"链接，当你点击链接时，它就是一个死链接。）

据我所知。

NetSqlAzMan提供了一个（表）用户定义的函数，您可以重载该函数以提供用户列表（分配给角色/任务）。NetSqlAzMan不仅提供"是的，你可以"映射（Grant），还提供Deny和Grant With Delegate。NetSqlAzMan和Azman允许用户（组）到角色的映射。只有NetSqlAzMan允许用户进行任务映射。

看了几个样品之后。。。NetSqlAzMan的对象模型非常干净。

==============================================

Ms授权管理器（AzMan）与.NET Sql授权管理器（NetSqlAzMan）

如前所述，类似的微软产品已经存在并且被称为授权管理器（AzMan）；AzMan出席，由默认值，在Windows Server 2003中，并且通过管理包设置，在Windows XP。

AzMan和NetSqlAzMan之间的重要区别在于第一种是基于角色，也就是说，基于归属-角色的概念和每个角色中的操作容器，而第二个是基于项目（或者如果您更喜欢基于操作），即用户或用户可以或不能属于角色或执行的组或组此类任务和/或操作（项目）。

以下是两者之间最重要的特点和区别产品：

AzMan女士：

* It's COM.
* It's equipped by a MMC 2.0 (COM) console.
* Its storage can be an XML file or ADAM (Active Directory Application Mode - e un LDAP).
* It's role-based.
* It supports static/dynamic applicative groups, members/not-members.
* Structure based on Roles -> Tasks -> Operations. (Hierarchical Roles and Tasks , none Operations).
* Authorizations can be added only to Roles.
* It doesn't implement the "delegate" concept.
* It doesn't manage authorizations "in the time".
* It doesn't trigger events.
* The only type of authorization is "Allow".
  (to "deny" it needs to remove the user/group from his Role).
* It supports Scripting / Biz rules.
* It supports Active Directory users/groups and ADAM users.

NetSqlAzMan:

* It's .NET 2.0.
* It's equipped by a MMC 3.0 (.NET) console.
* Its storage is a Sql Server database(2000/MSDE/2005/Express).
* It's based on Tdo - Typed Data Object technology.
* It's Item-based.
* Structure based on Roles -> Tasks -> Operations. (all hierarchical ones).
* Authorizations can be added to Roles, Task and Operations.
* It supports static/dynamic applicative groups, members/not-members.
* LDAP query testing directly from console.
* It's time-dependant.
* It's delegate-compliant.
* It triggers events (ENS).
* It supports 4 authorization types:
      o Allow with delegation (authorized and authorized to delegate).
      o Allow (authorized).
      o Deny (not authorized).
      o Neutral (neutral permission, it depends on higher level Item permission).
* Hierarchical authorizations.
* It supports Scripting / Biz rules (compiled in .NET - C# - VB - and not interpreted)
* It supports Active Directory users/groups and custom users defined in SQL Server Database.

还有一个。

Azman样本代码：http://channel9.msdn.com/forums/sandbox/252978-AzMan-in-the-Enterprise-Sample-Codehttp://channel9.msdn.com/forums/sandbox/252973-Programming-AzMan-Sample-Code

using System;
using System.Security.Principal;
using System.Runtime.InteropServices;
using AZROLESLib;
namespace TreyResearch {
    public class AzManHelper : IDisposable {
        AzAuthorizationStore store;
        IAzApplication app;
        string appName;
        public AzManHelper(string connectionString, string appName) {
            this.appName = appName;
            try {
                // load and initialize the AzMan runtime
                store = new AzAuthorizationStore();
                store.Initialize(0, connectionString, null);
                // drill down to our application
                app = store.OpenApplication(appName, null);
            }
            catch (COMException x) {
                throw new AzManException("Failed to initizlize AzManHelper", x);
            }
            catch (System.IO.FileNotFoundException x) {
                throw new AzManException(string.Format("Failed to load AzMan policy from {0} - make sure your connection string is correct.", connectionString), x);
            }
        }
        public void Dispose() {
            if (null == app) return;
            Marshal.ReleaseComObject(app);
            Marshal.ReleaseComObject(store);
            app = null;
            store = null;
        }
        public bool AccessCheck(string audit, Operations op,
                                WindowsIdentity clientIdentity) {
            try {
                // first step is to create an AzMan context for the client
                // this looks at the security identifiers (SIDs) in the user's
                // access token and maps them onto AzMan roles, tasks, and operations
                IAzClientContext ctx = app.InitializeClientContextFromToken(
                    (ulong)clientIdentity.Token.ToInt64(), null);
                // next step is to see if this user is authorized for
                // the requested operation. Note that AccessCheck allows
                // you to check multiple operations at once if you desire
                object[] scopes = { "" };
                object[] operations = { (int)op };
                object[] results = (object[])ctx.AccessCheck(audit, scopes, operations,
                                                             null, null, null, null, null);
                int result = (int)results[0];
                return 0 == result;
            }
            catch (COMException x) {
                throw new AzManException("AccessCheck failed", x);
            }
        }
        public bool AccessCheckWithArg(string audit, Operations op,
                                       WindowsIdentity clientIdentity,
                                       string argName, object argValue) {
            try {
                // first step is to create an AzMan context for the client
                // this looks at the security identifiers (SIDs) in the user's
                // access token and maps them onto AzMan roles, tasks, and operations
                IAzClientContext ctx = app.InitializeClientContextFromToken(
                    (ulong)clientIdentity.Token.ToInt64(), null);
                // next step is to see if this user is authorized for
                // the requested operation. Note that AccessCheck allows
                // you to check multiple operations at once if you desire
                object[] scopes = { "" };
                object[] operations = { (int)op };
                object[] argNames = { argName };
                object[] argValues = { argValue };
                object[] results = (object[])ctx.AccessCheck(audit, scopes, operations,
                                                             argNames, argValues,
                                                             null, null, null);
                int result = (int)results[0];
                return 0 == result;
            }
            catch (COMException x) {
                throw new AzManException("AccessCheckWithArg failed", x);
            }
        }
        // use this to update a running app
        // after you change the AzMan policy
        public void UpdateCache() {
            try {
                store.UpdateCache(null);
                Marshal.ReleaseComObject(app);
                app = store.OpenApplication(appName, null);
            }
            catch (COMException x) {
                throw new AzManException("UpdateCache failed", x);
            }
        }
    }
    public class AzManException : Exception {
        public AzManException(string message, Exception innerException)
          : base(message, innerException)
        {}
    }
}

这是阿兹曼助手代码。这是丑陋的COM/Interopish的东西<

现在检查NetSqlAzMan代码示例：

http://netsqlazman.codeplex.com/wikipage?title=Samples

/// <summary>
/// Create a Full Storage through .NET code
/// </summary>
private void CreateFullStorage()
{
    // USER MUST BE A MEMBER OF SQL DATABASE ROLE: NetSqlAzMan_Administrators
    //Sql Storage connection string
    string sqlConnectionString = "data source=(local);initial catalog=NetSqlAzManStorage;user id=netsqlazmanuser;password=password";
    //Create an instance of SqlAzManStorage class
    IAzManStorage storage = new SqlAzManStorage(sqlConnectionString);
    //Open Storage Connection
    storage.OpenConnection();
    //Begin a new Transaction
    storage.BeginTransaction(AzManIsolationLevel.ReadUncommitted);
    //Create a new Store
    IAzManStore newStore = storage.CreateStore("My Store", "Store description");
    //Create a new Basic StoreGroup
    IAzManStoreGroup newStoreGroup = newStore.CreateStoreGroup(SqlAzManSID.NewSqlAzManSid(), "My Store Group", "Store Group Description", String.Empty, GroupType.Basic);
    //Retrieve current user SID
    IAzManSid mySid = new SqlAzManSID(WindowsIdentity.GetCurrent().User);
    //Add myself as sid of "My Store Group"
    IAzManStoreGroupMember storeGroupMember = newStoreGroup.CreateStoreGroupMember(mySid, WhereDefined.Local, true);
    //Create a new Application
    IAzManApplication newApp = newStore.CreateApplication("New Application", "Application description");
    //Create a new Role
    IAzManItem newRole = newApp.CreateItem("New Role", "Role description", ItemType.Role);
    //Create a new Task
    IAzManItem newTask = newApp.CreateItem("New Task", "Task description", ItemType.Task);
    //Create a new Operation
    IAzManItem newOp = newApp.CreateItem("New Operation", "Operation description", ItemType.Operation);
    //Add "New Operation" as a sid of "New Task"
    newTask.AddMember(newOp);
    //Add "New Task" as a sid of "New Role"
    newRole.AddMember(newTask);
    //Create an authorization for myself on "New Role"
    IAzManAuthorization auth = newRole.CreateAuthorization(mySid, WhereDefined.Local, mySid, WhereDefined.Local, AuthorizationType.AllowWithDelegation, null, null);
    //Create a custom attribute
    IAzManAttribute<IAzManAuthorization> attr = auth.CreateAttribute("New Key", "New Value");
    //Create an authorization for DB User "Andrea" on "New Role"
    IAzManAuthorization auth2 = newRole.CreateAuthorization(mySid, WhereDefined.Local, storage.GetDBUser("Andrea").CustomSid, WhereDefined.Local, AuthorizationType.AllowWithDelegation, null, null);
    //Commit transaction
    storage.CommitTransaction();
    //Close connection
    storage.CloseConnection();
}

这本身就告诉了一个故事。

我认为微软在其博客和SDK中缺乏更新的原因与他们已经将所有工具和设计转向社交网络/联邦友好的"索赔模型"有关：

http://msdn.microsoft.com/en-us/magazine/ee335707.aspx

与任何AzMan变体相比，在较低的AzMan操作级别（代码要求将其与其他变体解耦），我们只有权限类型声明。这种新的操作风格只是由您定义的签名（或稍后重新配置）验证的任何受信任声明提供者/服务发出的URN字符串/操作名称。然后，它们只是用户标识中角色的平面列表，因此很容易使用常见的IsInRole方法进行检查。

这样做的理由是明确的。现代互联网解决方案（一旦隐私法得到改善，可能还会有一些未来的企业内部网应用程序）需要多域身份验证和授权，例如此StackOverflow.com用户帐户和连接的Facebook帐户或您可能链接的任何OpenID帐户。

因此，对于授权，您现在可以对映射在外部声明和内部"权限声明"之间的规则进行编码（类似于AzMan操作）。然而，没有标准的格式、层次结构或管理工具。

也许索赔服务（身份验证）+AzMan XML/SQL（角色到索赔映射）+索赔权限需求的混合解决方案是前进的方向。到目前为止，我发现的所有样本都有代码在中间。我想看到从Active Directory到角色到任务再到声明（操作）的递归组成员身份，就像我们在AzMan中已经拥有的一样。

需要进行更多的调查，以利用新技术实现"良好的旧"但仍然必不可少的"基于角色的安全"模式。。。

如果你想开始，请访问Microsoft Windows Identity Foundation（WIF），它最初出现在.NET 3.5.1中，但后来已集成到.NET 4.5框架中。

http://msdn.microsoft.com/en-us/library/hh377151（v=vs.110）.aspx