ThinkPHP中关于RBAC使用详解

RBAC是什么，能解决什么难题？

ThinkPHP中RBAC实现体系

安全拦截器

认证管理器

访问决策管理

运行身份管理器

ThinkPHP中RBAC认证流程

权限管理的具体实现过程

RBAC相关的数据库介绍

.class.php文件，

Extend/Library/ORG/Util

CREATE TABLE IF NOT EXISTS `ly_access` (
`role_id` smallint(6) unsigned NOT NULL,
`node_id` smallint(6) unsigned NOT NULL,
`level` tinyint(1) NOT NULL,
`module` varchar(50) DEFAULT NULL,
KEY `groupId` (`role_id`),
KEY `nodeId` (`node_id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;

CREATE TABLE IF NOT EXISTS `ly_node` (
`id` smallint(6) unsigned NOT NULL AUTO_INCREMENT,
`name` varchar(20) NOT NULL,
`title` varchar(50) DEFAULT NULL,
`status` tinyint(1) DEFAULT '0',
`remark` varchar(255) DEFAULT NULL,
`sort` smallint(6) unsigned DEFAULT NULL,
`pid` smallint(6) unsigned NOT NULL,
`level` tinyint(1) unsigned NOT NULL,
PRIMARY KEY (`id`),
KEY `level` (`level`),
KEY `pid` (`pid`),
KEY `status` (`status`),
KEY `name` (`name`)
) ENGINE=MyISAM  DEFAULT CHARSET=utf8;

CREATE TABLE IF NOT EXISTS `ly_role` (
`id` smallint(6) unsigned NOT NULL AUTO_INCREMENT,
`name` varchar(20) NOT NULL,
`pid` smallint(6) DEFAULT NULL,
`status` tinyint(1) unsigned DEFAULT NULL,
`remark` varchar(255) DEFAULT NULL,
PRIMARY KEY (`id`),
KEY `pid` (`pid`),
KEY `status` (`status`)
) ENGINE=MyISAM  DEFAULT CHARSET=utf8 ;

CREATE TABLE IF NOT EXISTS `ly_role_user` (
`role_id` mediumint(9) unsigned DEFAULT NULL,
`user_id` char(32) DEFAULT NULL,
KEY `group_id` (`role_id`),
KEY `user_id` (`user_id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;

实现RBAC管理的前导性工作

<?php
/**
* Created by PhpStorm.
* User: LiuYang
* Date: 14-9-6
* Time: 下午9:54
* Description: 基于ThinkPHP实现的权限管理系统
*/

class RbacAction extends CommonAction {

//初始化操作
function _initialize(){
if(!IS_AJAX) $this->error('你访问的页面不存在，请稍后再试');
}

//用户列表
public function index(){
$db = M('user');

//当前页码
$pageNum = I('post.pageNum',1,'int');
//每页显示条数
$numPerPage = I('post.numPerPage',C("numPerPage"),'int');
//总页码数
$totalCount = $db->count();

$this->totalCount = $totalCount;
$this->numPerPage = $numPerPage;
$this->items = D('UserRelation')->relation(true)->page($pageNum, $numPerPage)->select();
$this->display();
}

//添加编辑用户弹层表单
public function addUser(){
//如果设置了uid，则为编辑用户，否则为增加用户
$this->role = M('role')->where('status = 1')->field('id,name')->select();

if(isset($_GET['uid'])) {
$this->userinfo = M('user')->where( "id = $_GET[uid]" )->find();
}
$this->display();
}

//添加及编辑用户表单处理
public function addUserHandler(){

$db = M('user');
if($_POST['id']) {
//如果存在ID，即表示更新
$data = array(
'id' => I('post.id','','int'),
'username' => I('username', '', 'string'),
'status' => I('status','', 'int'),
'remark' => I('remark'),
'logintime' => time(),
'loginip' => get_client_ip()
);

if($_POST['password']) $data['password'] = I('password','', 'md5');
if($db->save($data)) {
$roleuser = M('role_user');

$roleuser->where("id = $data[id]")->delete();

$roleuser->add(array(
'role_id' => I('role','','intval'),
'user_id' => $data[id]
));

$this->ajaxReturn(array(
'statusCode' => 200,
'message' => '更新成功'
));
} else {
$this->ajaxReturn(array(
'statusCode' => 300,
'message' => '操作失败'
));
}

return ;
}

//添加表单处理
$data = array(
'username' => I('username', '', 'string'),
'password' => I('password', '', 'md5'),
'status' => I('status','', 'int'),
'remark' => I('remark'),
'logintime' => time(),
'loginip' => get_client_ip()
);
if($uid = M('user')->add($data)) {
$roleuser = M('role_user');

$roleuser->where("id = $uid")->delete();

$roleuser->add(array(
'role_id' => I('role','','intval'),
'user_id' => $uid
));

$this->ajaxReturn(array(
'statusCode' => 200,
'message' => '操作成功',
'navTabId' => '',
'rel' => '',
'callbackType' => '',
'forwardUrl' => '',
'confirmMsg' => ''
));
} else {
$this->ajaxReturn(array(
'statusCode' => 300,
'message' => '操作失败'
));
}
}

//启用或楚用用户
public function resume(){
$id = I('get.id','0','int');
$db = M('user');
$status = $db->where("id = $id")->getField('status');
$status = ($status == 1)? 0 : 1 ;
if($db->where("id = $id")->setField('status', $status)){
$this->ajaxReturn(array(
'statusCode' => 1,
'message' => '操作成功',
'navTabId' =>$_GET['navTabId']
));
} else {
$this->ajaxReturn(array(
'statusCode' => 0,
'message' => '操作失败'
));
}
}

//删除用户
public function deleteUserHandler(){
$id = I('get.uid',0,'int');
if( M('user')->delete($id) ) {
$this->ajaxReturn(array(
'statusCode' => 1,
'message' => '删除成功',
'navTabId' => $_GET['navTabId']
));
} else {
$this->ajaxReturn(array(
'statusCode' => 0,
'message' => '删除成功',
'navTabId' => $_GET['navTabId']
));
}
}

//节点列表
public function node(){
$node = M('node')->where(array('status'=>1))->order('sort')->select();
$this->node = node_merge($node);
$this->display();
}

//添加及编辑节点弹层表单
public function addNode(){
//添加表单默认情况
$this->info = array(
'level' => I('get.level',1,'int'),
'pid' => I('get.pid',0,'int'),
'status' => 1,
'sort' => 50
);
switch ($this->info['level']){
case 1: {
$this->label = "应用";
break;
}
case 2: {
$this->label = "控制器";
break;
}
case 3: {
$this->label = "方法";
break;
}
}
if($_GET['id']) {
//编辑模式
$this->info = M('node')->where(array('id'=>$_GET['id']))->find();
}
$this->display();
}

//添加及编辑节点表单处理
public function addNodeHandler(){
$id = $_POST['id'];
$db = M('node');
if($id) {
//更新
if($db->save($_POST)) {
$this->ajaxReturn(array(
'statusCode' => 200,
'message' => '添加成功',
'navTabId' => $_GET['navTabId']
));
} else {
$this->ajaxReturn(array(
'statusCode' => 300,
'message' => '更新失败',
'navTabId' => $_GET['navTabId']
));
}
}else {
//保存
if($db->add($_POST)) {
$this->ajaxReturn(array(
'statusCode' => 200,
'message' => '添加成功',
'navTabId' => $_GET['navTabId']
));
} else {
$this->ajaxReturn(array(
'statusCode' => 300,
'message' => '添加失败',
'navTabId' => $_GET['navTabId']
));
}
}
}

//删除节点
public function deleteNodeHandler(){
$id = I('get.id','0','int');
$db = M('node');
$data = $db->where(array('pid'=>$id))->field('id')->find();
if($data) {
$this->ajaxReturn(array(
'statusCode' => 0,
'message' => '你请求删除的节点存在子节点，不可直接删除'
));
} else {
if($db->delete($id)) {
$this->ajaxReturn(array(
'statusCode'=> 1,
'message' => '删除成功'
));
} else {
$this->ajaxReturn(array(
'statusCode' => 0,
'message' => '删除失败'
));
}
}
//if($data['level'] === 3)
}

//角色管理
public function role(){
$this->role = M('role')->select();
$this->display();
}

//添加及编辑角色
public function addRole(){
if($_GET['rid']) {
$id = I('get.rid',0,'int');
$this->role = M('role')->find($id);
}
$this->display();
}

//添加角色表单处理
public function addRoleHandler(){
$db = M('role');
if($_POST['id']) {
//更新
if($db->save($_POST)) {
$this->ajaxReturn(array(
'statusCode'=> 200,
'message' => "角色信息更新成功"
));
} else {
$this->ajaxReturn(array(
'statusCode' => "300",
'message' => '角色信息更新失败'
));
}
} else {
//添加表单处理
if($db ->add($_POST)){
$this->ajaxReturn(array(
'statusCode'=> 200,
'message' => "角色添加成功"
));
}else {
$this->ajaxReturn(array(
'statusCode' => 300,
'message' => '角色添加失败'
));
}
}
}

//删除角色
public function deleteRole(){

}

//快束启用或楚用用户
public function resumeRole(){
$id = I('get.rid',0, 'int');
$db = M('role');
$status = $db->where("id = $id")->getField('status');
$status = ($status == 1)? 0 : 1 ;
if($db->where("id = $id")->setField('status', $status)){
$this->ajaxReturn(array(
'statusCode' => 1,
'message' => '操作成功',
'navTabId' =>$_GET['navTabId']
));
} else {
$this->ajaxReturn(array(
'statusCode' => 0,
'message' => '操作失败'
));
}
}

//给用户添加节点权限
public function access(){
$rid = I('rid',0 ,'intval');
$node = M('node')->where(array('status'=>1))->field(array('id','title','pid','name','level'))->order('sort')->select();

//获取原有权限
$access = M('access')->where("role_id = $rid")->getField('node_id',true);
$this->node = node_merge($node,$access);
$this->assign('rid',$rid)->display();
}

//添加节点权限表单处理
public function accessHandler(){
$rid = I('rid', '', 'intval');
$db = M('access');
//清空原有权限
$db->where("role_id = $rid")->delete();

//插入新的权限
$data = array();

foreach ($_POST['access'] as $v) {
$tmp = explode('_', $v);
$data[] = array(
'role_id'=> $rid,
'node_id'=> $tmp[0],
'level'=>$tmp[1]
);
}
if($db->addAll($data)) {
$this->ajaxReturn(array(
'statusCode'=> 200,
'message' => '权限更新成功'
));
} else {
$this->ajaxReturn(array(
'statusCode' => 300,
'message' => '权限更新失败'
));
}

}
}

ThinkPHP中RBAC类的详解

<?php
/**
* Created by PhpStorm.
* User: LiuYang
* Date: 14-9-29
* Time: 下午9:36
* Description: ThinkPHP中RBAC处理类的配置文件
*/

return array(

"USER_AUTH_ON" => true,                    //是否开启权限验证(必配)
"USER_AUTH_TYPE" => 1,                     //验证方式（1、登录验证；2、实时验证）

"USER_AUTH_KEY" => 'uid',                  //用户认证识别号(必配)
"ADMIN_AUTH_KEY" => 'superadmin',          //超级管理员识别号(必配)
"USER_AUTH_MODEL" => 'user',               //验证用户表模型 ly_user
'USER_AUTH_GATEWAY'  =>  '/Public/login',  //用户认证失败，跳转URL

'AUTH_PWD_ENCODER'=>'md5',                 //默认密码加密方式

"RBAC_SUPERADMIN" => 'admin',              //超级管理员名称

"NOT_AUTH_MODULE" => 'Index,Public',       //无需认证的控制器
"NOT_AUTH_ACTION" => 'index',              //无需认证的方法

'REQUIRE_AUTH_MODULE' =>  '',              //默认需要认证的模块
'REQUIRE_AUTH_ACTION' =>  '',              //默认需要认证的动作

'GUEST_AUTH_ON'   =>  false,               //是否开启游客授权访问
'GUEST_AUTH_ID'   =>  0,                   //游客标记

"RBAC_ROLE_TABLE" => 'ly_role',            //角色表名称(必配)
"RBAC_USER_TABLE" => 'ly_role_user',       //用户角色中间表名称(必配)
"RBAC_ACCESS_TABLE" => 'ly_access',        //权限表名称(必配)
"RBAC_NODE_TABLE" => 'ly_node',            //节点表名称(必配)
);

RBAC处理类提供静态的方法

$map:

$model:

C('USER_AUTH_MODEL')

RBAC::authenticate(array("username"=>"admin","userpwd"
=> I('POST.pwd','', 'md5')));

where

$authId:

C('USER_AUTH_KEY');

$authId:

$module:

$appName:

true:

false:

$authId:

$authId:

$module:

RBAC::AccessDecision()

//权限验证
if(C('USER_AUTH_ON') && !$notAuth) {
import('ORG.Util.RBAC');
//使用了项目分组，则必须引入GROUP_NAME
RBAC::AccessDecision(GROUP_NAME) || $this->error("你没有对应的权限");
}

RBAC处理类的实际应用

>?php
/**
* Created by PhpStorm.
* User: LiuYang
* Date: 14-8-24
* Time: 下午5:23
* Description: 用户登户及退出控制器
*/

class LoginAction extends Action {

//用户登录视图
public function index(){
//...
}

//用户登录处理表单
public function loginHandle(){
if(!IS_POST) halt('页面不存在，请稍后再试');
if(session('verify') != I('param.verify','','md5')) {
$this->error('验证码错误', U('Admin/Login/index'));
}

$user = I('username','','string');
$passwd = I('password','','md5');

$db = M('user');
$userinfo = $db->where("username = '$user' AND password = '$passwd'")->find();

if(!$userinfo) $this->error('用户名或密码错误', U('Admin/Login/index'));

if(!$userinfo['status']) $this->error('该用户被锁定，暂时不可登录', U('Admin/Login/index'));

//更新登录信息
$db->save(array("id"=> $userinfo["id"], "logintime"=> time(), "loginip" => get_client_ip()));

//写入session值
session(C("USER_AUTH_KEY"), $userinfo["id"]);
session("username", $userinfo["username"]);
session("logintime", $userinfo["logintime"]);
session("loginip",$user["loginip"]);

//如果为超级管理员，则无需验证
if($userinfo['username'] == C('RBAC_SUPERADMIN')) {
session(C('ADMIN_AUTH_KEY'), true);
}

//载入RBAC类
import('ORG.Util.RBAC');
//读取用户权限
RBAC::saveAccessList();

$this->success('登录成功', U('Admin/Index/index'));
}

//登出登录
public function logOut(){
//...
}

//验证码
public function verify(){
//...
}
}

CommonAction.class.php

CommonAction

<?php
/**
* Created by PhpStorm.
* User: LiuYang
* Date: 14-9-3
* Time: 下午8:40
* Description: 操作权限验证
*/

class CommonAction extends Action {
function _initialize(){
if(!isset($_SESSION[C('USER_AUTH_KEY')])) {
$this->redirect('Admin/Login/index');
}

$notAuth = in_array(MODULE_NAME, explode(',', C('NOT_AUTH_MODULE'))) || in_array(ACTION_NAME, C('NOT_AUTH_ACTION'));

//权限验证
if(C('USER_AUTH_ON') && !$notAuth) {
import('ORG.Util.RBAC');
//使用了项目分组，则必须引入GROUP_NAME
RBAC::AccessDecision(GROUP_NAME) || $this->error("你没有对应的权限");
}}
}
在[code]ThinkPHP

_initialize()

CommonAction

_initialize()