I am pretty much confused as to when I should implement an ACL (access control list) system in my application though I can easily manage permissions on groups simply by fetching the session group id and restricting the access using the Auth component.
我很困惑何时应该在我的应用程序中实现ACL（访问控制列表）系统，尽管我可以通过获取会话组ID并使用Auth组件限制访问来轻松管理组的权限。
How is an ACL solution better then the approach I discussed above (restricting the group access based on group id) ?
ACL解决方案如何比我上面讨论的方法更好（根据组ID限制组访问）？
How does implementing an ACL solution simplify things when it comes to managing access rights in your application ?
在管理应用程序中的访问权限时，实施ACL解决方案如何简化？
Till now I have learned that through ACL, permissions can be granted and revoked at runtime, but this functionality is also achievable without using an ACL.
到目前为止，我已经了解到，通过ACL，可以在运行时授予和撤销权限，但是在不使用ACL的情况下也可以实现此功能。
I am very much confused about this, please help me understand the concept, when to use ACL and the benefits of using ACL in your web application.
我对此非常困惑，请帮助我理解这个概念，何时使用ACL以及在Web应用程序中使用ACL的好处。
I prefer to code with cakePHP v1.3 so it would be great if the explanation is given in context of cakephp but any help (language/technology independent) related to my question is greatly appreciated.
我更喜欢用cakePHP v1.3进行编码，所以如果在cakephp的上下文中给出解释会很好，但是非常感谢与我的问题相关的任何帮助（语言/技术独立）。
2 个解决方案
#1
10
You must use ACLs (or an equivalent user permission mechanism such as literal database User and Permission tables) rather than groups if you need to control access to individual entities which vary dynamically. File systems attach ACL's to individual files since you don't want to create a separate group for each file. Database managers attach ACL's to databases, tables, views, stored procedures and whatnot for the same reason. Web servers deal with web applications in the same manner.
如果需要控制对动态变化的单个实体的访问，则必须使用ACL（或等效的用户权限机制，如文字数据库用户和权限表）而不是组。文件系统将ACL附加到单个文件，因为您不希望为每个文件创建单独的组。出于同样的原因，数据库管理器将ACL附加到数据库，表，视图，存储过程等等。 Web服务器以相同的方式处理Web应用程序。
In a business application dealing with business entities, you may want to partition access to entities such as e.g. different sales orders, customers, products or divisions within your company, where not everybody is allowed to create/update or even read the same entities. For instance, when sales staff are in direct competition for bonuses, they don't want everybody else to see all the information on their CRM-stored prospects.
在处理业务实体的业务应用程序中，您可能希望对对诸如公司内部的不同销售订单，客户，产品或部门，不允许每个人创建/更新甚至读取相同的实体。例如，当销售人员直接竞争奖金时，他们不希望其他人看到他们CRM存储的潜在客户的所有信息。
Usually, though, you want to keep your access mechanisms as coarse-grained as is humanly possible: groups are usually good enough. Fine-grained access control mechanisms have a tendency to grow complex, expensive, inaccurate and hard to use correctly. They may even decrease security, since administrative frustration encourages people to find clever workarounds...
但是，通常，您希望将访问机制保持为尽可能粗糙的访问机制：组通常足够好。细粒度的访问控制机制具有复杂，昂贵，不准确和难以正确使用的趋势。他们甚至可能会降低安全性，因为行政挫折鼓励人们找到聪明的解决方法......
#2
0
I think that ACL technic for securising user access to ressources is usefull only for a typical or medium - sized application . for big applications like CRM or financial data warehouses , ACLs will fail to manage a very complex set of user / ressource couples , when the data increase in size , in type and in volume , the ACLs tables made for that purpose will increase too , which it make for me no sense to overload the database server with ACL Tables. There are many others technics used to install security access and permissions and privileges ... The use of ACL files instead does not sound bad but it is not a good idea as files may corrupt from time to time so data failure is over the risk to not have access to a file containing ACL rules or to access a non existing file or a lost one ... The only way to play with permission is to use the business tables used in the context or in the purpose of your application with relationships between your tables and some logic to add to your Service Side Scripts if you are under MVC Architecture or any else ... So Avoid using ACL for very big sized applications.
我认为用于证明用户访问资源的ACL技术仅适用于典型或中型应用程序。对于像CRM或财务数据仓库这样的大型应用程序，ACL将无法管理一组非常复杂的用户/资源对，当数据大小，类型和数量增加时，为此目的而制作的ACL表也将增加，对于使用ACL表重载数据库服务器没有任何意义。还有许多其他技术用于安装安全访问和权限和权限......使用ACL文件听起来不是很糟糕，但这不是一个好主意，因为文件可能会不时损坏，因此数据失败超过风险无权访问包含ACL规则的文件或访问非现有文件或丢失的文件...使用权限的唯一方法是使用上下文中或业务目的中使用的业务表以及之间的关系如果你在MVC架构下或其他任何地方，你的表和一些逻辑要添加到你的服务端脚本中......所以避免在非常大的应用程序中使用ACL。
#1
10
You must use ACLs (or an equivalent user permission mechanism such as literal database User and Permission tables) rather than groups if you need to control access to individual entities which vary dynamically. File systems attach ACL's to individual files since you don't want to create a separate group for each file. Database managers attach ACL's to databases, tables, views, stored procedures and whatnot for the same reason. Web servers deal with web applications in the same manner.
如果需要控制对动态变化的单个实体的访问，则必须使用ACL（或等效的用户权限机制，如文字数据库用户和权限表）而不是组。文件系统将ACL附加到单个文件，因为您不希望为每个文件创建单独的组。出于同样的原因，数据库管理器将ACL附加到数据库，表，视图，存储过程等等。 Web服务器以相同的方式处理Web应用程序。
In a business application dealing with business entities, you may want to partition access to entities such as e.g. different sales orders, customers, products or divisions within your company, where not everybody is allowed to create/update or even read the same entities. For instance, when sales staff are in direct competition for bonuses, they don't want everybody else to see all the information on their CRM-stored prospects.
在处理业务实体的业务应用程序中，您可能希望对对诸如公司内部的不同销售订单，客户，产品或部门，不允许每个人创建/更新甚至读取相同的实体。例如，当销售人员直接竞争奖金时，他们不希望其他人看到他们CRM存储的潜在客户的所有信息。
Usually, though, you want to keep your access mechanisms as coarse-grained as is humanly possible: groups are usually good enough. Fine-grained access control mechanisms have a tendency to grow complex, expensive, inaccurate and hard to use correctly. They may even decrease security, since administrative frustration encourages people to find clever workarounds...
但是，通常，您希望将访问机制保持为尽可能粗糙的访问机制：组通常足够好。细粒度的访问控制机制具有复杂，昂贵，不准确和难以正确使用的趋势。他们甚至可能会降低安全性，因为行政挫折鼓励人们找到聪明的解决方法......
#2
0
I think that ACL technic for securising user access to ressources is usefull only for a typical or medium - sized application . for big applications like CRM or financial data warehouses , ACLs will fail to manage a very complex set of user / ressource couples , when the data increase in size , in type and in volume , the ACLs tables made for that purpose will increase too , which it make for me no sense to overload the database server with ACL Tables. There are many others technics used to install security access and permissions and privileges ... The use of ACL files instead does not sound bad but it is not a good idea as files may corrupt from time to time so data failure is over the risk to not have access to a file containing ACL rules or to access a non existing file or a lost one ... The only way to play with permission is to use the business tables used in the context or in the purpose of your application with relationships between your tables and some logic to add to your Service Side Scripts if you are under MVC Architecture or any else ... So Avoid using ACL for very big sized applications.
我认为用于证明用户访问资源的ACL技术仅适用于典型或中型应用程序。对于像CRM或财务数据仓库这样的大型应用程序，ACL将无法管理一组非常复杂的用户/资源对，当数据大小，类型和数量增加时，为此目的而制作的ACL表也将增加，对于使用ACL表重载数据库服务器没有任何意义。还有许多其他技术用于安装安全访问和权限和权限......使用ACL文件听起来不是很糟糕，但这不是一个好主意，因为文件可能会不时损坏，因此数据失败超过风险无权访问包含ACL规则的文件或访问非现有文件或丢失的文件...使用权限的唯一方法是使用上下文中或业务目的中使用的业务表以及之间的关系如果你在MVC架构下或其他任何地方，你的表和一些逻辑要添加到你的服务端脚本中......所以避免在非常大的应用程序中使用ACL。