uap63權(quán)限應(yīng)用關(guān)鍵技術(shù)說明

1、LFW 權(quán)限技術(shù)紅皮書軟件2013 年 9 月 29 日文檔更改審校批準(zhǔn)分發(fā)序號(hào)分發(fā)地點(diǎn)職位簽字日期審校人版本審校意見日期作者版本更改參考/備注2011-12-011.0所有。©2013的，本白皮書任何整體或部分的內(nèi)容不得被、復(fù)印、翻譯或縮減以用于任何目的。本白皮書的內(nèi)容在通知的情形下可能會(huì)發(fā)生改變，敬請留意。請注意：本白皮書的內(nèi)容并不代表軟件所做的承諾。目錄前言.3目錄4第一章前言61.1.特色6第二章權(quán)限模型7權(quán)限基礎(chǔ)數(shù)據(jù)8第三章3.1.協(xié)同用戶組83.2.協(xié)同用戶143.3.協(xié)同用戶.173.4.協(xié)同組213.5.29協(xié)同3.6.協(xié)同組織333.7.協(xié)同職責(zé)363.8.協(xié)同組織

2、權(quán)393.9.協(xié)同功能權(quán)423.10.協(xié)同職責(zé)483.11.協(xié)同職責(zé)523.12.協(xié)同權(quán)限.57第四章組織權(quán)限674.1.抽象多組織模型674.2.協(xié)同組織接口與參照68第五章功能菜單715.1.功能節(jié)點(diǎn)715.2.菜單75第一章前言1.1.介紹輕量級(jí)權(quán)限管理方案采取 RBAC 基于的權(quán)限模型，支持功能節(jié)點(diǎn)、布局、portlet 等多種權(quán)限；支持權(quán)限擴(kuò)展；支持組織級(jí)功能、組織級(jí)職責(zé)， 借助職責(zé)實(shí)現(xiàn)權(quán)限復(fù)用，提供了更易用、更細(xì)粒度的權(quán)限管理機(jī)制；支持集中與分層的體系；支持組織權(quán)、功能權(quán)，組織級(jí)的管理員可以直接分配其關(guān)聯(lián)組織的功能節(jié)點(diǎn)，不需要功能；支持權(quán)限。輕量級(jí)權(quán)限管理方案能夠更適合于輕量級(jí)全員

3、性應(yīng)用的特點(diǎn)，減少了對富客戶端系統(tǒng)管理的依賴。本文檔通過權(quán)限模型、基礎(chǔ)數(shù)據(jù)、組織權(quán)限、功能菜單四個(gè)維度，系統(tǒng)介紹了輕量級(jí)權(quán)限管理方案。第二章權(quán)限模型上圖是協(xié)同權(quán)限的領(lǐng)域模型圖，具體特性如下：n協(xié)同用戶與NC 用戶之間是交集關(guān)系，關(guān)聯(lián)的NC 用戶會(huì)自動(dòng)同步到協(xié)同用戶中；nNC 用戶與協(xié)同用戶關(guān)聯(lián)的用戶，主鍵、編碼保持一致；新增用戶編碼需要 NC 用戶、協(xié)同用戶中不存在；n用戶組包括多個(gè)用戶，組包括多個(gè)；n每個(gè)組織均有的默認(rèn)（everyone），新建用戶時(shí)會(huì)自動(dòng)關(guān)聯(lián)到當(dāng)前組織的默認(rèn)；everyone的功能權(quán)限需要手工配置。n可關(guān)聯(lián)多個(gè)職責(zé)，每個(gè)職責(zé)可關(guān)聯(lián)多個(gè)n的來源包括功能節(jié)點(diǎn)、菜單、布局、por

4、tlet 等n用戶、用戶組、組都有的所屬組織（或業(yè)務(wù)單元）n需分配關(guān)聯(lián)組織，支持管控的功能節(jié)點(diǎn)，可管理的組織列表加載的就是關(guān)聯(lián)了該節(jié)點(diǎn)的的關(guān)聯(lián)組織列表合集n、組、職責(zé)、的類型均分為管理類型、業(yè)務(wù)類型。第三章權(quán)限基礎(chǔ)數(shù)據(jù)3.1. 協(xié)同用戶組n用戶組來源分為 portal 用戶組和 NC 用戶組。系統(tǒng)對 nc 用戶組的增刪改操作進(jìn)行了，進(jìn)行自動(dòng)同步。n用戶組是用戶的合集，一個(gè)用戶組可以包括多個(gè)用戶。一個(gè)用戶只有一個(gè)用戶組。n每個(gè)用戶組有所屬組織和所屬，支持組織管控。.vos.CpUserGroupVO接口.itf.ICpUserGroupQr

5、y提供了按、組織、父用戶組等條件用戶組的方法/* 所有用戶組* return* throws PortalServiceException*/publiUserGroupVO glUserGroups() throwsCpbBusinessException;/* 根據(jù)where條件用戶組* param where* return* throws CpbBusinessException*/publiUserGroupVO getUserGroupVos(String where) throwsCpbBusinessException;/* 根據(jù)pk用戶組* param pk_usergrou

6、p* return* throws PortalServiceException*/publiUserGroupVO getUserGroupByPk(String pk_usergroup) throwsCpbBusinessException;/* 根據(jù)pk用戶組* param pk_usergroup* return* throws PortalServiceException*/publiUserGroupVO getUserGroupByGroupPk(String pk_group) throwsCpbBusinessException;/* 某個(gè)用戶組下的第一級(jí)子用戶組* par

7、am pk_parent* return* throws CpbBusinessException*/publiUserGroupVO getUserGroupByParent(String pk_parent) throwsCpbBusinessException;/* 根據(jù)用戶組Id用戶組* param groupcode* return* throws PortalServiceException*/publiUserGroupVO getUserGroupByGroupCode(String groupcode)throws CpbBusinessException;/* 根據(jù)pk_o

8、rg,用戶組Id用戶組* param groupcode* return* throws PortalServiceException*/publiUserGroupVO getUserGroupByGroupCode(String pk_org,String groupcode) throws CpbBusinessException;/* 根據(jù)用戶組名稱用戶組* param groupname* return* throws PortalServiceException*/publiUserGroupVO getUserGroupByGroupName(String groupname)t

9、hrows CpbBusinessException;/* 根據(jù)多個(gè)用戶組pk批量用戶組* param pk_usergroups* return* throws PortalServiceException*/publiUserGroupVO getUserGroupByPkS(String pk_usergroups)throws CpbBusinessException;/* 除掉除去pk_usergroup外的所有用戶組* param pk_usergroup* return* throws PortalServiceException*/publiUserGroupVO glUser

10、GroupExcp(String pk_usergroup)throws CpbBusinessException;/* 按照pk_org* param pk_org* return* throws CpbBusinessException業(yè)務(wù)接口：.itf.ICpUserGroupBill提供了新增、修改、刪除方法/* 用戶組* param usergroupvo* throws PortalServiceException*/public String addPtUserGroupVO(CpUserGroupVO usergroupvo) throwsCpbBu

11、sinessException;/* 用戶組* param usergroupvos* throws CpbBusinessException*/public void addPtUserGroupVOWithPk(CpUserGroupVO usergroupvos)throws CpbBusinessException;/* 更新用戶組* param usergroupvo* throws PortalServiceException*/public void updatePtUserGroupVO(CpUserGroupVO usergroupvo) throws*/publiUserG

12、roupVO getUserGroupByOrgPk(String pk_org) throwsCpbBusinessException;協(xié)同用戶組預(yù)置參照：cp_usergroup協(xié)同用戶組.refrence.CpUserGroupTreeGridNCRefMCpbBusinessException;/* 根據(jù)pk刪除用戶組* param pk_usergroup* throws PortalServiceException*/public void deletePtUserGroupVO(String pk_usergroup) throwsCpbBusines

13、sException;/* 刪除用戶組* param usergroupvo* throws PortalServiceException*/public void deletePtUserGroupVO(CpUserGroupVO usergroupvo) throwsCpbBusinessException;/* 刪除用戶組* param usergroupvos* throws PortalServiceException*/public void deletePtUserGroupVOs(CpUserGroupVO usergroupvos)throws CpbBusinessExce

14、ption;3.2. 協(xié)同用戶nportal 中用戶的來源包括 NC 用戶和協(xié)同用戶。系統(tǒng)中對 NC 用戶的增刪改進(jìn)行，自動(dòng)同步。n用戶按照類型分為系統(tǒng)管理員、管理員、普通用戶。其中系統(tǒng)管理員和集團(tuán)管理員默認(rèn)不受權(quán)限管控。為普通用戶即為該用戶授予，一個(gè)用戶可以具有多個(gè)。n每個(gè)用戶有所屬組織和所屬，支持組織管控。協(xié)同用戶 VO 類：.vos.CpUserVO元數(shù)據(jù)實(shí)體模型如下：接口.itf.ICpUserQry提供了按照用戶 pk、code、部門信息、自定義條件等進(jìn)行用戶的方法。業(yè)務(wù)接口.itf.ICpUserB

15、ill提供了新增、修改、刪除用戶、用戶登錄等方法。部分方法如下：/* 用戶信息* param uservo* throws PortalServiceException*/public String addCpUserVO(CpUserVO uservo) throwsCpbBusinessException;/* 新增用戶* param uservo* return* throws CpbBusinessException*/public String addCpUserVOWithPk(CpUserVO uservo) throwsCpbBusinessException;/* 更新用戶*

16、 param userVo* throws CpbBusinessException*/public void updateCpUserVO(CpUserVO userVo) throwsCpbBusinessException;/* 批量更新用戶* param userVos* return* throws CpbBusinessException*/publiUserVO updateCpUserVOs(CpUserVO userVos)throws CpbBusinessException;/* 更新用戶所用語言* param uservo* param languageId* thro

17、ws PortalServiceException*/public void changeUserLanguage(String pk_user, String languageId) throws CpbBusinessException;/* 刪除用戶信息* param pk_user* throws PortalServiceException*/public void deleteCpUserVO(String pk_user) throwsCpbBusinessException;/* 刪除用戶信息用戶相關(guān)接口：.itf.ICpUserPasswordSe

18、rvice提供了校驗(yàn)、初始信息、歷史信息相關(guān)方法協(xié)同用戶預(yù)置參照：3.3. 協(xié)同用戶n協(xié)同用戶表是用戶與的關(guān)聯(lián)表。維護(hù)用戶關(guān)系也就是對這張表進(jìn)行操作。n一個(gè)用戶可以關(guān)聯(lián)上多個(gè)，一個(gè)可以分配給多個(gè)用戶。協(xié)同用戶關(guān)聯(lián) VO 類：.vos.CpUserRoleVO具體模型如下圖cp_user協(xié)同用戶.refrence.CpUserTreeGridNCRefM* param uservo* throws PortalServiceException*/public void deleteCpUserVO(CpUserVO uservo) thro

19、wsCpbBusinessException;/*批量 刪除用戶信息* param uservos* throws PortalServiceException*/public void deleteCpUserVOs(CpUserVO uservos)throws CpbBusinessException;相關(guān)接口：接口：.itf.ICpUserRoleQry提供了按用戶、pk關(guān)聯(lián)表的方法/* 按用戶pk* param pk_user* return* throws CpbBusinessException*/publiUserRoleVO getPtRoleUs

20、erByPkuser(String pk_user) throwsCpbBusinessException;/* 按pk* param pk_role* return* throws CpbBusinessException*/publiUserRoleVO getPtRoleUserByPkRole(String pk_role) throwsCpbBusinessException;/* 按用戶pk批量* param pk_users* return* throws CpbBusinessException業(yè)務(wù)操作接口：.itf.ICpUserRoleBill提

21、供了用戶關(guān)聯(lián)表的增刪改方法。/* 用戶關(guān)聯(lián)vo* param roleUservo* throws PortalServiceException*/public String addPtRoleUserVO(CpUserRoleVO roleUservo) throwsCpbBusinessException;/* 批量用戶關(guān)聯(lián)vo* param roleUservos*/publiUserRoleVO getPtRoleUserByPkusers(String pk_users)throws CpbBusinessException;/* 按pk批量* param pk_roles* ret

22、urn* throws CpbBusinessException*/publiUserRoleVO getPtRoleUserByPkRoles(String pk_roles)throws CpbBusinessException;* return* throws PortalServiceException*/public void addPtRoleUserVOS(CpUserRoleVO roleUservos) throwsCpbBusinessException;/* 刪除用戶關(guān)聯(lián)vo* param roleUservo* throws PortalServiceException

23、*/public void deletePtRoleUserVO(CpUserRoleVO roleUservo) throwsCpbBusinessException;/* 刪除用戶關(guān)聯(lián)vo* param roleUservos* throws CpbBusinessException*/public void deletePtRoleUserVOs(CpUserRoleVO roleUservos) throwsCpbBusinessException;/* 按PK刪除用戶關(guān)聯(lián)vo* param pk_role* throws PortalServiceException*/public

24、void deletePtRoleUserByRolepk(String pk_role) throwsCpbBusinessException;3.4. 協(xié)同組n組分為管理類組和業(yè)務(wù)類組。n組是的合集。一個(gè)組可以包含多個(gè)同類型，一個(gè)只能擁/* 按PK批量刪除用戶關(guān)聯(lián)vo* param pk_role* throws PortalServiceException*/public void deletePtRoleUserByRolepks(String rolePKs) throwsCpbBusinessException;/* 按用戶PK批量刪除用戶關(guān)聯(lián)vo* param pk_user*

25、throws PortalServiceException*/public void deletePtRoleUserByUserpks(String pk_users) throwsCpbBusinessException;/* 修改用戶關(guān)聯(lián)vo* param roleUservos* throws CpbBusinessException*/publiUserRoleVO updatePtRoleUsers(CpUserRoleVO roleUservos)throws CpbBusinessException;有一個(gè)組。n組有所屬組織和所屬，支持組織管控。.

26、vos.CpRoleGroupVO接口：.itf.ICpRoleGroupQry提供了按組 pk、編碼、父組、組織等條件組方法/* 所有組* return* throws PortalServiceException*/publiRoleGroupVO glRoleGroups() throwsCpbBusinessException;/* 根據(jù)pk組* return* throws PortalServiceException*/publiRoleGroupVO getRoleGroupByPk(String pk_rolegroup) throwsCpbBusi

27、nessException;/* 根據(jù)組編碼組* param groupcode* return* throws PortalServiceException*/publiRoleGroupVO getRoleGroupByGroupCode(String groupcode)throws CpbBusinessException;/* 根據(jù)組名組* param groupname* return* throws PortalServiceException*/publiRoleGroupVO getRoleGroupByGroupName(String groupname)throws Cp

28、bBusinessException;/* 某一公司下的組* param pk_corp* return* throws PortalServiceException*/publiRoleGroupVO getRoleGroupByPkcorp(String pk_corp) throwsCpbBusinessException;publiRoleGroupVO getRoleGroupByParent(String pk_parent) throwsCpbBusinessException;/* 根據(jù)where條件組* param where* return* throws CpbBusin

29、essException*/publiRoleGroupVO getRoleGroupVos(String where) throwsCpbBusinessException;/* 組* param pk_group* param type* return* throws PortalServiceException*/publiRoleGroupVO getRoleGroupByPkgroup(String pk_group, String type) throws CpbBusinessException;/* 組* param pk_group* param type* return*

30、throws PortalServiceException*/publiRoleGroupVO getRoleGroupByPkgroup(String pk_group) throwsCpbBusinessException;/* 根據(jù)多個(gè)pk批量組* param pk_rolegroups* return* throws PortalServiceException*/publiRoleGroupVO getRoleGroupByPkS(String pk_rolegroups)throws CpbBusinessException;/* 除去pk外的所有組* param pk_roleg

31、roup* return* throws PortalServiceException*/publiRoleGroupVO getRoleGroupExc(String pk_rolegroup) throwsCpbBusinessException;/* 組織組業(yè)務(wù)接口： .itf.ICpRoleGroupBill提供了組的增刪改方法/* param pk_orgs* return* throws PortalServiceException*/publiRoleGroupVO getRoleGroupByPkorgs(String pk_orgs) throws

32、CpbBusinessException;/* 按照組編碼和組* param groupcode* param pk_group* return* throws CpbBusinessException*/publiRoleGroupVO getRoleGroupByGroupCodeAndPkGroup(String groupcode,String pk_group) throws CpbBusinessException;/* 按照組編碼和組* param groupcode* param pk_org* return* throws CpbBusinessException*/publ

33、iRoleGroupVO getRoleGroupByGroupCodeAndPkOrg(String groupcode,String pk_org) throws CpbBusinessException;* 初始化組織組* param uservo* throws PortalServiceException*/publiRoleGroupVO initRoleGroupVos(String pk_org) throwsCpbBusinessException;/* 組* param uservo* throws PortalServiceException*/public String

34、 addPtRoleGroupVO(CpRoleGroupVO rolegroupvo) throwsCpbBusinessException;/* 批量組* param rolegroupvos* return* throws PortalServiceException*/public String addPtRoleGroupVOs(CpRoleGroupVO rolegroupvos)throws CpbBusinessException;/* 更新組* param rolegroupvo* throws PortalServiceException*/public void upda

35、tePtRoleGroupVO(CpRoleGroupVO rolegroupvo) throwsCpbBusinessException;/*根據(jù)pk 刪除組* param pk_rolegroup* throws PortalServiceException*/public void deletePtRoleGroupVO(String pk_rolegroup) throwsCpbBusinessException;/* 刪除組* param rolegroupvo* throws PortalServiceException*/public void deletePtRoleGroup

36、VO(CpRoleGroupVO rolegroupvo) throwsCpbBusinessException;/* 刪除組* param rolegroupvos* throws PortalServiceException協(xié)同組預(yù)置參照：3.5. 協(xié)同n是權(quán)限的合集。與權(quán)限的關(guān)系是通過與職責(zé)關(guān)聯(lián)，職責(zé)再關(guān)聯(lián)權(quán)限來體現(xiàn)。n在 portal 中，分為管理類和業(yè)務(wù)類。n有所屬組織和所屬，支持組織管控。協(xié)同.vos.CpRoleVO模型如下接口：.itf.ICpRoleQry部分方法如下：/*cp_rolegroup協(xié)同角色組nc.uap.

37、.refrence.CpRoleGroupTreeGridNCRefM*/public void deletePtRoleGroupVOs(CpRoleGroupVO rolegroupvos)throws CpbBusinessException;* 根據(jù)where條件* return* throws PortalServiceException*/publiRoleVO getRoleVos(String where) throwsCpbBusinessException;/* 除去指定pk外的所有* param pk_role* return* throws PortalS

38、erviceException*/publiRoleVO glRolesExcp(String pk_role) throwsCpbBusinessException;/* 根據(jù)pk* param pk_role* return* throws PortalServiceException*/publiRoleVO getRoleByPk(String pk_role) throwsCpbBusinessException;/* 根據(jù)部門pk* param pk_dept* return* throws PortalServiceException*/publiRoleVO getRoleBy

39、DeptPk(String pk_dept) throwsCpbBusinessException;/* 根據(jù)編碼* param rolecode* return* throws PortalServiceException*/publiRoleVO getRoleByRolecode(String rolecode) throwsCpbBusinessException;/* 根據(jù)編碼和* param rolecode* return* throws PortalServiceException*/publiRoleVO getRoleByRolecodeAndPkgroup(String

40、rolecode,String pk_group) throws CpbBusinessException;/* 根據(jù)編碼和組織* param rolecode業(yè)務(wù)接口：.itf.ICpRoleBill提供了的增刪改方法。/* param rolevo* throws PortalServiceException*/public String addCpRoleVO(CpRoleVO rolevo) throwsCpbBusinessException;/* 批量增加* param rolevos* return* throws PortalServiceExcep

41、tion*/public String addCpRoleVOs(CpRoleVO rolevos) throwsCpbBusinessException;/* 更新* param rolevo* throws PortalServiceException*/* return* throws PortalServiceException*/publiRoleVO getRoleByRolecodeAndPkorg(String rolecode,String pk_org) throws CpbBusinessException;3.6. 協(xié)同組織n協(xié)同組織是與組織的關(guān)聯(lián)表。n用戶關(guān)聯(lián)了某，則

42、用戶在該下的權(quán)限時(shí)，擁有該所關(guān)聯(lián)的組織的組織權(quán)限。public void updateCpRoleVO(CpRoleVO rolevo) throwsCpbBusinessException;/* 根據(jù)pk刪除* param pk_role* throws PortalServiceException*/public void deleteCpRoleVO(String pk_role) throwsCpbBusinessException;/* 刪除* param rolevo* throws PortalServiceException*/public void deleteCpRoleV

43、O(CpRoleVO rolevo) throwsCpbBusinessException;/* 刪除* param rolevo* throws PortalServiceException*/public void deleteCpRoleVO(CpRoleVO rolevos) throwsCpbBusinessException;n一個(gè)可以關(guān)聯(lián)多個(gè)組織，一個(gè)組織可以分配給多個(gè)。Vo 類為 .vos.CpRoleOrgVO，其具體模型如下業(yè)務(wù)接口 .itf.ICpRoleOrgBill提供了組織關(guān)聯(lián)關(guān)系的刪除和新增方法/* 新增組織

44、關(guān)聯(lián)* param roleorgvo* return* throws CpbBusinessException*/public String addCpRoleOrgVO(CpRoleOrgVO roleorgvo) throwsCpbBusinessException;/* 批量新增組織關(guān)聯(lián)* param roleorgvos* return* throws CpbBusinessException*/public String addCpRoleOrgVOs(CpRoleOrgVO roleorgvos) throwsCpbBusinessException;/* 按pk刪除關(guān)聯(lián)* pa

45、ram pk_role* throws CpbBusinessException*/public void deleteCpRoleOrgVOsByRolePK(String pk_role) throwsCpbBusinessException;/* 按pk批量刪除關(guān)聯(lián)* param rolePKs* throws CpbBusinessException*/public void deleteCpRoleOrgVOsByRolePKs(String rolePKs) throwsCpbBusinessException;/* 刪除組織關(guān)聯(lián)關(guān)系* param roleorgvo* throws CpbBusinessException*/public void deleteCpRoleOrgVOs(CpRoleOrgVO roleorgvo) throwsCpbBusinessException;/* 批量刪除組