blocks|key|1500316|text|您可以在DB中使用保存角色的字段，但可以阅读有关ACL和RBAC的信息。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1500317|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

You can use a field in your DB that saves the role, but you can read about ACL and RBAC.

blocks|key|229203|text|我建议您看一下spring安全https://projects.spring.io/spring-security/#quick-start|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|229204|entityMap|0|LINK|mutability|MUTABLE|url|https://projects.spring.io/spring-security/#quick-start^0|F|1J|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

I will recommend having a look at spring security <a href="https://projects.spring.io/spring-security/#quick-start" rel="nofollow noreferrer">https://projects.spring.io/spring-security/#quick-start</a>

blocks|key|751490|text|问得好。实际上，这个扩展是针对您的小的完整的身份验证模块。公共页面是最好的解决方案。根据角色所需的文本框或字段，将出现。例如，在“角色学生:主题”的情况下，将提供卷号。但是，如果教授登录到同一页，他可以看到其他字段，如数字、考勤等。最简单的解决方案可以是：创建一个主表，其中包含名称、Id、类型(其中有是否为学生/教授/管理员等类型)，并使用这种类型作为显示字段的决定性因素。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|751491|entityMap^0|I|12|38|C|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]|$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|M|8|@]|D|@]|E|$]]]|G|$]]

Good question. Actually extension of this is complete authentication module
For your small case A common page is the best solution. As per the role desired text boxes or fields will appear.
For Example, in case Role Student: subject, roll number will be available. But in case Professor logs in into same page, he can see additional fields like numbers, attendance etc.
Easiest solution can be: To Create a master table, with Name, Id, TYPE(With there type whether student/Professor/Admin etc.), and use this TYPE as the decisive factor for showing fields.

blocks|key|229338|text|你的问题没有一个答案。一切都取决于项目的结构。如果您提到的角色之间有许多共同之处，那么最好对所有角色使用一个index.jsp。然后，您不必重复公共逻辑(js和css库、自定义公共脚本、视图和样式包含)。如果角色之间没有什么共同之处，那么最好为每个角色创建单独的index.jsp文件，因为在程序执行过程中将根据所选角色动态创建单个index.jsp文件(我认为仍然可以通过缓存修复)。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|229339|在我们的项目中，我们对单个index.jsp文件使用了一种方法。这首先是因为他们有许多共同的逻辑。但无论如何你都会做出决定的。|229340|此外，如果您正在使用Security，并且可以在项目开发过程中添加新的角色，那么@PreAuthorize+("hasRole+('ROLE_USER')")方法将是不好的。因为如果要向数据库中添加新角色，就必须向项目中添加大量代码，才能授予这个新角色所需的访问权限。因此，在这种情况下，最好通过权限授予访问权限。并在roles+<->+permissions之间创建关系permissions|229341|entityMap^0|25|2|28|3|0|0|14|13|4F|5|4P|B|56|B|0^^$0|@$1|2|3|4|5|6|7|L|8|@$9|M|A|N|B|C]|$9|O|A|P|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|Q|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|R|8|@$9|S|A|T|B|C]|$9|U|A|V|B|C]|$9|W|A|X|B|C]|$9|Y|A|Z|B|C]]|D|@]|E|$]]|$1|J|3|-4|5|6|7|10|8|@]|D|@]|E|$]]]|K|$]]

There is no single answer to your question. Everything depends on the structure of the project. If there is much in common between the roles you mentioned, then it's better to use a single index.jsp for all roles. Then you do not have to duplicate the common logic (<code>js</code> and <code>css</code> libraries, custom common scripts, views and styles inclusion). If there is little in common between the roles, then it's better to have separate index.jsp files for each role, since single index.jsp file will be dynamically created during the execution of the program depending on selected role (I think it's still possible to fix by caching).

In our projects, we use an approach with a single index.jsp file. This is due in the first place to the fact that they have a lot of common logic. But in any case decision will be taken by you.

Additionally, if you are using Spring Security and it's possible to add new roles during the process of developing of the project, then the <code>@PreAuthorize ("hasRole ('ROLE_USER')")</code> approach will be not good. Because if you'll add new role to the data base you will have to add a lot of code to the project to grant this new role required access. So, in this case will be better to grant access via permissions. And create relationship <code>many to many</code> between <code>roles</code> &lt;-> <code>permissions</code>

blocks|key|751661|text|对于不同的角色，您肯定不希望有单独的页面(“名称空间”)，因为这几乎不可避免地会导致代码重复。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|751662|您应该为每个函数创建一个页面，并根据用户的角色限制访问。(例如，一些菜单项对于学生来说是不可见的，但对于教授和管理员则是可见的。)|751663|您绝对不应该尝试重新发明管理基于角色的权限的方向盘，因为有一些经过战斗验证的框架可用于此目的:正如其他人已经指出的那样，在Java中，Spring和弹簧安全是可行的。|offset|length|751664|我认为随着技术的老化，JSP应该开始学习角度了。|751665|由于获得一个工作的Spring+/角项目设置并不简单，所以我建议您使用JHipster应用程序生成器指导您使用向导完成整个过程(您只需回答一些问题--当被问到选择monolithic+web+application类型时)：然后按照现代建议创建一个具有基于角色的安全性的工作项目配置。|style|CODE|751666|如果您想了解现代web应用程序中正确的基于角色的访问控制，那么查看JHipster生成的应用程序中使用的解决方案，我认为是最好和最快的解决方案：|751667|它使用Security特性来限制Java后端中的调用:查找生成的项目中org.springframework.security.access.annotation.Secured注释的用法|unordered-list-item|751668|展示一些定制的前端技巧来显示/隐藏基于角色的某些UI部件，比如：<h1+*jhiHasAnyAuthority="'ROLE_ADMIN'">Hello,+admin+user</h1>，您可以很容易地将它应用到自己的用例中。|751669|您可以在大约2分钟内完成一个工作项目:学习的理想选择(最简单的monolithic+web+application!)|751670|entityMap|0|LINK|mutability|MUTABLE|url|https://projects.spring.io/spring-security|1|https://angular.io/|2|http://www.jhipster.tech/^0|0|0|22|4|0|0|K|2|1|0|29|Q|Z|F|2|0|0|Z|1I|0|W|1P|0|V|Q|0^^$0|@$1|2|3|4|5|6|7|18|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|19|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|1A|8|@]|9|@$F|1B|G|1C|1|1D]]|A|$]]|$1|H|3|I|5|6|7|1E|8|@]|9|@$F|1F|G|1G|1|1H]]|A|$]]|$1|J|3|K|5|6|7|1I|8|@$F|1J|G|1K|L|M]]|9|@$F|1L|G|1M|1|1N]]|A|$]]|$1|N|3|O|5|6|7|1O|8|@]|9|@]|A|$]]|$1|P|3|Q|5|R|7|1P|8|@$F|1Q|G|1R|L|M]]|9|@]|A|$]]|$1|S|3|T|5|R|7|1S|8|@$F|1T|G|1U|L|M]]|9|@]|A|$]]|$1|U|3|V|5|R|7|1V|8|@$F|1W|G|1X|L|M]]|9|@]|A|$]]|$1|W|3|-4|5|6|7|1Y|8|@]|9|@]|A|$]]]|X|$Y|$5|Z|10|11|A|$12|13]]|14|$5|Z|10|11|A|$12|15]]|16|$5|Z|10|11|A|$12|17]]]]

You definitely do NOT want to have separate pages ("namespaces") for different roles as that would almost inevitably lead to code duplication. 

You should have a page for each function and restrict access based on the roles of the users. (e.g. some menu items are not visible for a Student, but shown for Professors and Admins.)

You absolutely should not try re-inventing the wheel for managing role based permissions, as there are battle proven frameworks for that purpose: as others pointed out already, in Java world, Spring and <a href="https://projects.spring.io/spring-security" rel="noreferrer">Spring Security</a> is the way to go.

I think JSP as technology is getting aged, so you should probably start learning <a href="https://angular.io/" rel="noreferrer">Angular</a> instead. 

Since getting a working Spring / Angular project setup is not trivial, I would recommend you to use <a href="http://www.jhipster.tech/" rel="noreferrer">JHipster application generator</a> that guides you through the whole process with a wizard (you have to just answer some questions -- when asked about the type select <code>monolithic web application</code>): it then creates a working project configuration with role based security in place following modern recommendations.

If you want to learn about proper role based access control in a modern web application, looking at the solutions used in a JHipster generated application is I believe the best and fastest solution:

<ul>
<li>it uses Spring Security features to restrict calls in the Java
backend: look for the usages of <code>org.springframework.security.access.annotation.Secured</code> annotation in the generated project</li>
<li>shows some custom frontend tricks to show/hide certain UI
parts based on roles, like this:
<code>&lt;h1 *jhiHasAnyAuthority="'ROLE_ADMIN'"&gt;Hello, admin user&lt;/h1&gt;</code>, which you could easily adopt to your own use case.</li>
<li>you can have a working project in like 2 minutes: ideal for learning (go for the most simple <code>monolithic web application</code>!)</li>
</ul>

blocks|key|229469|text|有不同的页面违反了干燥(不要重复自己)的原则。如果你想要一个简单的解决方案，在你的web应用程序中添加过滤器，并在那里进行授权(委托第三方应用程序)。您需要在组级别在jsp页面中添加条件，这样就不需要每次都更改它。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|229470|您还可以使用Spring安全性和jdbc身份验证。|229471|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Having different pages violates the DRY (Don't repeat yourself) principle.
If you want a simple solution, add Filters in your web app and do your authorisation there (delegate to 3rd party app). You would need to add conditions in the jsp page at a group level so that it need not be changed every time.

You can also use Spring security and jdbc authentication.

blocks|key|751600|text|我不确定我的解决办法能解决你的问题。但就我而言，我是这样做的：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|751601|用户0.n--0.m角色|751602|角色0.n--0.m特权|751603|生产代码|offset|length|751604|在您的情况下，您可能希望：|751605|Admin无法查看，编辑学生成绩。|unordered-list-item|style|CODE|751606|Student可以查看分数，但不能编辑。|751607|Professor可以查看、编辑、添加分数。|751608|你可以这样做：|751609|角色|751610|ROLE_SCORE_EDITOR|751611|ROLE_SCORE_VIEWER|751612|特权|751613|OP_READ_SCORE|751614|OP_CREATE_SCORE|751615|OP_UPDATE_SCORE|751616|OP_DELETE_SCORE|751617|角色特权|751618|751619|751620|751621|751622|751623|751624|用户角色|751625|管理员(这真的取决于你，在我的情况下，我应该把它空着)|751626|教授|751627|751628|学子|751629|751630|然后，在模板中，只需使用user.hasPrivilege或user.hasRole来保护视图。会很好的。|751631|对不起，我的英语很差。如果您需要任何东西，请在下面评论或评论我的要旨|751632|entityMap|0|LINK|mutability|MUTABLE|url|https://gist.github.com/liemle3893/b32e2a568f6522e1faa6f79e76a4443e|1^0|0|0|0|0|4|0|0|0|0|5|0|0|7|0|0|9|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|C|H|U|C|0|W|2|1|0^^$0|@$1|2|3|4|5|6|7|27|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|28|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|29|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|2A|8|@]|9|@$H|2B|I|2C|1|2D]]|A|$]]|$1|J|3|K|5|6|7|2E|8|@]|9|@]|A|$]]|$1|L|3|M|5|N|7|2F|8|@$H|2G|I|2H|O|P]]|9|@]|A|$]]|$1|Q|3|R|5|N|7|2I|8|@$H|2J|I|2K|O|P]]|9|@]|A|$]]|$1|S|3|T|5|N|7|2L|8|@$H|2M|I|2N|O|P]]|9|@]|A|$]]|$1|U|3|V|5|6|7|2O|8|@]|9|@]|A|$]]|$1|W|3|X|5|6|7|2P|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|N|7|2Q|8|@]|9|@]|A|$]]|$1|10|3|11|5|N|7|2R|8|@]|9|@]|A|$]]|$1|12|3|13|5|6|7|2S|8|@]|9|@]|A|$]]|$1|14|3|15|5|N|7|2T|8|@]|9|@]|A|$]]|$1|16|3|17|5|N|7|2U|8|@]|9|@]|A|$]]|$1|18|3|19|5|N|7|2V|8|@]|9|@]|A|$]]|$1|1A|3|1B|5|N|7|2W|8|@]|9|@]|A|$]]|$1|1C|3|1D|5|6|7|2X|8|@]|9|@]|A|$]]|$1|1E|3|Z|5|6|7|2Y|8|@]|9|@]|A|$]]|$1|1F|3|15|5|N|7|2Z|8|@]|9|@]|A|$]]|$1|1G|3|17|5|N|7|30|8|@]|9|@]|A|$]]|$1|1H|3|19|5|N|7|31|8|@]|9|@]|A|$]]|$1|1I|3|11|5|6|7|32|8|@]|9|@]|A|$]]|$1|1J|3|15|5|N|7|33|8|@]|9|@]|A|$]]|$1|1K|3|1L|5|6|7|34|8|@]|9|@]|A|$]]|$1|1M|3|1N|5|6|7|35|8|@]|9|@]|A|$]]|$1|1O|3|1P|5|6|7|36|8|@]|9|@]|A|$]]|$1|1Q|3|Z|5|N|7|37|8|@]|9|@]|A|$]]|$1|1R|3|1S|5|6|7|38|8|@]|9|@]|A|$]]|$1|1T|3|11|5|N|7|39|8|@]|9|@]|A|$]]|$1|1U|3|1V|5|6|7|3A|8|@$H|3B|I|3C|O|P]|$H|3D|I|3E|O|P]]|9|@]|A|$]]|$1|1W|3|1X|5|6|7|3F|8|@]|9|@$H|3G|I|3H|1|3I]]|A|$]]|$1|1Y|3|-4|5|6|7|3J|8|@]|9|@]|A|$]]]|1Z|$20|$5|21|22|23|A|$24|25]]|26|$5|21|22|23|A|$24|25]]]]

I'm not sure my solution will work against your problem. But in my case, I do it as follow:

User 0..n --- 0..m Role

Role 0..n --- 0..m Privilege

<a href="https://gist.github.com/liemle3893/b32e2a568f6522e1faa6f79e76a4443e" rel="noreferrer">Production code</a>

In your case you may want:

<ul>
<li><code>Admin</code> cannot view, edit student score.</li>
<li><code>Student</code> can view score but cannot edit.</li>
<li><code>Professor</code> can view, edit, add score.</li>
</ul>

You can do as below:

<h2>Role</h2>

<ul>
<li>ROLE_SCORE_EDITOR</li>
<li>ROLE_SCORE_VIEWER</li>
</ul>

<h2>Privilege</h2>

<ul>
<li>OP_READ_SCORE</li>
<li>OP_CREATE_SCORE</li>
<li>OP_UPDATE_SCORE</li>
<li>OP_DELETE_SCORE ---> Probably dont need this one but it enough for an example.</li>
</ul>

<h2>Role - Privilege</h2>

<h3>ROLE_SCORE_EDITOR</h3>

<ul>
<li>OP_READ_SCORE</li>
<li>OP_CREATE_SCORE</li>
<li>OP_UPDATE_SCORE</li>
</ul>

<h3>ROLE_SCORE_VIEWER</h3>

<ul>
<li>OP_READ_SCORE</li>
</ul>

<h2>User - Role</h2>

<h3>Admin (It's really depends on you, In my case I should leave it empty)</h3>

<h3>Professor</h3>

<ul>
<li>ROLE_SCORE_EDITOR</li>
</ul>

<h3>Studen</h3>

<ul>
<li>ROLE_SCORE_VIEWER</li>
</ul>

Then in your template just guard your view with <code>user.hasPrivilege</code> or <code>user.hasRole</code>. It's will work fine.

P/s: Sorry for my bad English. If you need any thing please comment below or comment into my <a href="https://gist.github.com/liemle3893/b32e2a568f6522e1faa6f79e76a4443e" rel="noreferrer">gist</a>

blocks|key|229541|text|您可以创建不同的角色来访问不同的受限区域。例如，您可以有学生、教授和管理员的角色。稍后，您可以根据角色允许或阻止对内容的访问。弹簧安全可能对你有好处。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|229542|entityMap|0|LINK|mutability|MUTABLE|url|http://projects.spring.io/spring-security/^0|1R|4|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

You can create different roles to give access to different restricted areas. For example, you can have Student, Professor and Admin roles. Later you can allow or prevent the access to the content based on the roles. <a href="http://projects.spring.io/spring-security/" rel="nofollow noreferrer">Spring Security</a> may be good for you.

blocks|key|1500684|text|我现在也有类似的情况。我的项目需要身份验证和基于角色的授权.Java应用程序有许多可用的解决方案。我们的团队决定使用凯克雅克，这是一个额外的应用程序，您可以处理大多数用户管理。它可以在单独的服务器上运行。不过，取决于应用程序的范围，这可能是过火了。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1500685|在我看来，您还没有实现任何身份验证。这个部分在我的例子中已经完成了，并且大部分是通过在Keycloak+%2B+web服务器上的配置来完成的。|1500686|通常，您可以在大多数现代web服务器中使用Java安全性进行授权。这将允许您使用@RolesAllowed这样的注释来授予或拒绝访问权，并且可以工作，而不管是否使用Keycloak。示例。通过这种方式，您可以为所有不同的角色保留一个统一的结构，并且只能在执行请求之前决定请求的合法性。|1500687|entityMap|0|LINK|mutability|MUTABLE|url|http://www.keycloak.org/|1|https://www.ibm.com/support/knowledgecenter/SS8PJ7_9.0.0/com.ibm.javaee.doc/topics/tsecuringejee.html^0|1M|4|0|0|0|2J|2|1|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]]|C|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]]|C|$]]|$1|H|3|-4|5|6|7|10|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]|P|$5|K|L|M|C|$N|Q]]]]

I am in a similar situation right now. My Project(s) need Authentication and role-based Authorization. There are a number of solutions available for Java applications. Our team decided to use <a href="http://www.keycloak.org/" rel="nofollow noreferrer">Keycloak</a>, which is an extra app where you can handle most of the user management. It can run on a seperate server. Though, depending on the scope of your app, it might be overkill.

As I see it, you have not yet implemented any Authentication. That part is finished in my case and it was mostly done through configuration in Keycloak + web server. 

Generally, you can use Java EE security for Authorization in most modern web servers. This will allow you to use Annotations like @RolesAllowed to grant or deny access and can work regardless of Keycloak. <a href="https://www.ibm.com/support/knowledgecenter/SS8PJ7_9.0.0/com.ibm.javaee.doc/topics/tsecuringejee.html" rel="nofollow noreferrer">Examples</a>. This way you can keep a unified structure for all your different roles and only decide the legitimacy of a request just before it is executed.

blocks|key|229600|text|您可以创建基于名称类似于role_user的表，您可以在此基础上隔离|type|unstyled|depth|inlineStyleRanges|entityRanges|data|229601|不同角色|229602|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

you can create table based named like role_user based on that you can segregate

different roles

blocks|key|751677|text|尝试使用spring框架和spring安全性开发您的web应用程序--请参阅下面的示例http://websystique.com/spring-security/spring-security-4-role-based-login-example/|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|751678|entityMap|0|LINK|mutability|MUTABLE|url|http://websystique.com/spring-security/spring-security-4-role-based-login-example/^0|17|2A|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Try to develop your web app using spring framework and spring security 
Please refer the below example
<a href="http://websystique.com/spring-security/spring-security-4-role-based-login-example/" rel="nofollow noreferrer">http://websystique.com/spring-security/spring-security-4-role-based-login-example/</a>

blocks|key|1500872|text|我相信你应该和Spring+Security一起前进。它为您提供了许多现成的功能，配置和维护应用程序变得非常容易。此外，当库为您处理身份验证和授权(简单单词中的角色)时，您将能够更多地关注构建应用程序的逻辑。此外，它还有很多社区支持。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1500873|下面是一个需要开始的示例：春季保安-你好世界|1500874|从上面的示例中，让我展示一段代码片段，以便更多地支持我的声明：|1500875|@Override
++++protected+void+configure(HttpSecurity+http)+throws+Exception+{

++++++http.authorizeRequests()
++++++++.antMatchers("/admin/**").access("hasRole('ROLE_ADMIN')")
++++++++.antMatchers("/dba/**").access("hasRole('ROLE_ADMIN')+or+hasRole('ROLE_DBA')")
++++++++.and().formLogin();

++++}|code-block|syntax|javascript|1500876|因此，当您尝试访问/admin页面或管理页面下的任何url+(例如/admin/profile、/admin/home等)时，您将被要求验证自己的身份(在您的情况下使用用户名和密码)。spring安全性将检查用户名和密码是否正确。除此之外，它还将检查所提供的用户名是否具有角色管理。如果(密码和角色)检查都成功了，那么只有您可以访问该页面。|1500877|因此，只需几行代码，您就可以通过应用程序的角色管理来控制整个安全性。|1500878|虽然在示例文章中使用了硬编码的用户名，但是插入数据库也相当容易。但是，这个示例是一个很好的开始方式，可以自己查看它是否适合您的用例。|1500879|entityMap|0|LINK|mutability|MUTABLE|url|https://www.mkyong.com/spring-security/spring-security-hello-world-annotation-example/^0|7|F|0|D|9|0|0|0|0|9|6|X|E|1C|B|0|0|0^^$0|@$1|2|3|4|5|6|7|12|8|@$9|13|A|14|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|15|8|@]|D|@$9|16|A|17|1|18]]|E|$]]|$1|H|3|I|5|6|7|19|8|@]|D|@]|E|$]]|$1|J|3|K|5|L|7|1A|8|@]|D|@]|E|$M|N]]|$1|O|3|P|5|6|7|1B|8|@$9|1C|A|1D|B|C]|$9|1E|A|1F|B|C]|$9|1G|A|1H|B|C]]|D|@]|E|$]]|$1|Q|3|R|5|6|7|1I|8|@]|D|@]|E|$]]|$1|S|3|T|5|6|7|1J|8|@]|D|@]|E|$]]|$1|U|3|-4|5|6|7|1K|8|@]|D|@]|E|$]]]|V|$W|$5|X|Y|Z|E|$10|11]]]]

I believe you should go forward with <code>Spring Security</code>. It provides you many features out of the box and configuring and maintaining your application becomes so much easier. Also, you will be able to focus more on building the logic of your application while the library handles the Authentication and Authorization(the roles in simple words) for you. Plus it has a lot of community support.

Here is an example to get started: <a href="https://www.mkyong.com/spring-security/spring-security-hello-world-annotation-example/" rel="nofollow noreferrer">Spring security - hello world</a>

From the example above, let me show a snippet of code to give more weight to my claim:

<pre><code>@Override
 protected void configure(HttpSecurity http) throws Exception {

 http.authorizeRequests()
 .antMatchers("/admin/**").access("hasRole('ROLE_ADMIN')")
 .antMatchers("/dba/**").access("hasRole('ROLE_ADMIN') or hasRole('ROLE_DBA')")
 .and().formLogin();

 }
</code></pre>

So what the above config will do is, whenever you try to access the <code>/admin</code> page or any url under admin pages e.g. <code>/admin/profile</code>, <code>/admin/home</code> etc., you will be asked to authenticate yourself ( with a username and password in your case). The spring security will check whether the username and password is correct. In addition to this, it will also check if the provided username has role admin. If both (password and role) check succeed, then only you will be allowed to access that page.

So with just few lines of code you are controlling entire security with role management for your application. 

Although in the example post, hard coded usernames are used but plugging your db is also pretty easy. But the example is a good way to get started and see for yourself if it fits your use case.

blocks|key|1500900|text|解决这个问题有多种方法。例如，您可以使用筛选器来验证和授权您的资源访问不同的用户/角色。除此之外，Security还提供了内置机制，以确保对web资源的授权访问。除此之外，您还可以在应用程序中创建一个管理面板，并且可以将不同的页面分配给不同的角色(但是，这种方法需要更多的编程工作)。您还可以考虑在web.xml中创建安全约束，并且可以将web资源集合与不同的角色关联起来。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1500901|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

There are multiple approaches for this problem. For example, you can use a filter to authenticate and authorise the access of your resources to different users/roles. Other than this, Spring Security provides builtin mechanism to ensure authorised access to the web resources. Other than this, you can create an admin panel in your application, and you can assign different pages to different roles (but, this approach involves more programming work). You can also think to create security constraints in web.xml and you can associate web-resource-collections with different roles.

blocks|key|1500936|text|最好的方法是：弹簧安全|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1500937|但这需要时间和学习才能做到正确，所以在那之前，我会做这样的事情：|1500938|假设数据库中有一个表用户。添加列名，例如user_rights。|ordered-list-item|style|BOLD|1500939|在您的应用程序中，本列是用户模型类的字段。|1500940|创建一个检查此字段并按您的意愿处理角色的方法。|1500941|例如，如果用户角色确定他们可以访问哪些页面，这是一个简化的代码示例：|1500942|在你的网页开始时：|1500943|<h:body>

<f:metadata>
++++<f:viewAction+action="#{userService.checkIfLogged()}"+/>
++++<f:viewAction+action="#{userService.accessCheck('page+2')}"+/>
</f:metadata>|code-block|syntax|javascript|1500944|在你的bean方法中：|1500945|@Override
@Transactional
public+String+accessCheck(String+page)+{
++++try+{
+++++++HttpSession+sess+=+Util.getSession();
+++++++String+user+=+sess.getAttribute("username").toString();
+++++++Session+session+=+this.sessionFactory.getCurrentSession();
+++++++User+logged+=+(User)+session.createQuery("select+u+from+User+u+where+
+++++++++++++++++++++u.username+=+:logged").setParameter("logged",+
++++++++++++++++++++++++++++++++++++++++++++user).uniqueResult();
+++++++if+(page.equals("page+1"))+{
++++++++if+(logged.getRights().equals("simple"))+{
++++++++++++return+"profile?faces-redirect=true";
++++++++}+
++++++++else+{
++++++++++++return+"#";
++++++++}
++++}+++...+etc.|1500946|希望这是有帮助的，我仍然推荐Spring框架的功能，但同时，这对我的小web应用程序完美的工作。|1500947|entityMap|0|LINK|mutability|MUTABLE|url|https://projects.spring.io/spring-security/^0|7|4|0|0|0|A|2|0|C|5|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1B|8|@]|9|@$A|1C|B|1D|1|1E]]|C|$]]|$1|D|3|E|5|6|7|1F|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|1G|8|@$A|1H|B|1I|I|J]]|9|@]|C|$]]|$1|K|3|L|5|H|7|1J|8|@$A|1K|B|1L|I|J]]|9|@]|C|$]]|$1|M|3|N|5|H|7|1M|8|@]|9|@]|C|$]]|$1|O|3|P|5|6|7|1N|8|@]|9|@]|C|$]]|$1|Q|3|R|5|6|7|1O|8|@]|9|@]|C|$]]|$1|S|3|T|5|U|7|1P|8|@]|9|@]|C|$V|W]]|$1|X|3|Y|5|6|7|1Q|8|@]|9|@]|C|$]]|$1|Z|3|10|5|U|7|1R|8|@]|9|@]|C|$V|W]]|$1|11|3|12|5|6|7|1S|8|@]|9|@]|C|$]]|$1|13|3|-4|5|6|7|1T|8|@]|9|@]|C|$]]]|14|$15|$5|16|17|18|C|$19|1A]]]]

Best approach would be : <a href="https://projects.spring.io/spring-security/" rel="nofollow noreferrer">Spring Security</a>
But it needs time and studying to do it the right way, so till then I do something like this:
<ol>
<li>Say you have a table user in your database. Add a column name e.g. user_rights.</li>
<li>In your application this column is a field of your User model class</li>
<li>Create a method which checks this field and handles the roles as you wish</li>
</ol>
For instance, if a users role determines on what pages they have access, this is a simplified code example:
At the begining of your web-page:
<pre><code>&lt;h:body&gt;

&lt;f:metadata&gt;
 &lt;f:viewAction action=&quot;#{userService.checkIfLogged()}&quot; /&gt;
 &lt;f:viewAction action=&quot;#{userService.accessCheck('page 2')}&quot; /&gt;
&lt;/f:metadata&gt;
</code></pre>
and in your bean method:
<pre><code>@Override
@Transactional
public String accessCheck(String page) {
 try {
 HttpSession sess = Util.getSession();
 String user = sess.getAttribute(&quot;username&quot;).toString();
 Session session = this.sessionFactory.getCurrentSession();
 User logged = (User) session.createQuery(&quot;select u from User u where 
 u.username = :logged&quot;).setParameter(&quot;logged&quot;, 
 user).uniqueResult();
 if (page.equals(&quot;page 1&quot;)) {
 if (logged.getRights().equals(&quot;simple&quot;)) {
 return &quot;profile?faces-redirect=true&quot;;
 } 
 else {
 return &quot;#&quot;;
 }
 } ... etc.
</code></pre>
Hope this is helpful, I still recommend Spring framework's features, but in the meantime this works perfect for me for small web apps.

I need to create a web application for a School and I need to have different roles such as:

<ul>
<li>Student</li>
<li>Professor</li>
<li>Admin</li>
</ul>

I need to have a login at the beginning and then after entering the credentials the application needs to redirect to the home page. 

The question here is: How should I handle the roles? Should I have a namespace for each role? i.e: students/index.jsp, professors/index.jsp, admin/index.jsp or have a common namespace for all roles? something like home/index.jsp? and then use decorator/composite pattern to have the menus have different options based on the role?

For this question I know that I must store the users and the roles, each on in it's own table, this question is more related abour handling presentation/navigation/permission roles and how to create the webapp structure, i.e have a directory under webapp folder called students, another folder admin, and another one students and about the point I mentioned above (decorator or composite pattern)

Of course I am not making an app this small but I wanted to simplify the issues I am facing in order to create a big role web based application, and I believe these are the main principles.

Thank you for your time and help.

What is the best approach to create a role based web application?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我需要为一所学校创建一个网络应用程序，我需要有不同的角色，例如：学生教授管理员我需要在开始时登录，然后在输入凭据后，应用程序需要重定向到主页。问题是:我该如何处理这些角色？我应该为每个角色设置一个命名空间吗？也就是说:学生/index.jsp，教授/index.jsp，admin/index.jsp，还是有一个适用于所...

问创建基于角色的web应用程序的最佳方法是什么？
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问创建基于角色的web应用程序的最佳方法是什么？EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问创建基于角色的web应用程序的最佳方法是什么？
EN