Designing an IAM Framework with Oracle Identity and Access Management Suite[文摘]

下面这段文字还是从标题的书中摘录出来的。

What do I mean by that? Well, the thing so many companies have gotten wrong is: they have 10,000 users and 30,000 roles. If I can do five different things as part of my job, then I have five roles. If the guy sitting next to me also has five different roles, then between us we have ten different roles. Ouch! I’ve actually heard of even worse examples, where organizations had literally millions of roles, with the excuse being, “Everybody is unique.” As a product manager at Oracle puts it, “When everybody is unique, nobody is unique.”

Let’s say I’m appearing in a Shakespeare play. Let’s go with Titus Andronicus, because it’s extremely violent and bloody, much like the software market. If I’m appearing as Titus in one theater, and there’s another production of the same play down t he street, I’m not Titus-1 while the other guy is Titus-2. We’re both reading from the same scri pt. We’re both Titus. We’ve both been assigned that same role. What’s different is our context, since we’re in different theaters, and besides that, I’m tall, swarthy, handsome, and articulate, and the other guy’s kind of ugly. But we both have the same essential role, speak the same lines, and end up in the same horrid way.So instead of 30,000 roles for 10,000 people, it should be 10,000 roles for 30,000 people.

But wait, there’s more! It should probably be more like 100 rol es for 10,000 people, a vast order of magnitude less. Don’t turn a slight variation into an excus e for a whole new role. If the plastics division has a Quality Control Officer, and so does the metals division, then you have one role, with the context being the division. The grant of that role may still require different approvers; remember not to confuse the role with the granting of that rol e. But the baseline definition of the role will be consistent, yet flexible. Using context as a quali fier on a role keeps the number of roles from exploding.

总结来说，定义role的时候，最佳实践尽量减少role的个数。要区分role和context，比如这个人是某某部门经理，这个可以当作是一个role，但是他的location应该是作为一个context。因此在IAM项目实施的时候，注意不要设计过多的role。

Designing an IAM Framework with Oracle Identity and Access Management Suite[文摘]相关推荐

AP Autosar平台设计 14 身份和访问管理Identity and Access Management
目录 14身份和访问管理Identity and Access Management 14.1术语 14.2IAM框架的范围和重点: 14.3AUTOSAR规范的内容 14.4 IAM框架的架构 14 ...
Identity and Access Management - 介绍
Oracle数据库与Access互导实例
Oracle数据库与Access互导实例 (1)把Access实际相关应用数据导入Oracle数据库的步骤是,首先打开Access数据库,选择你所需要导入的表,在将表名与各个列名改写为大写字母(导入O ...
Android 进阶——Framework 核心之Android Storage Access Framework（SAF）存储访问框架机制详解（一）
文章大纲引言一.Android Storage Access Framework 二.Storage Access Framework 的主要角色成员 1.Document Provider 文件 ...
Android 进阶——Framework 核心之Android Storage Access Framework（SAF）存储访问框架机制详解（二）
文章大纲引言一.DirectFragment 1.当选中DirectoryFragment中RecyclerView的Item时 2.选中DirectoryFragment中RecyclerVie ...
oracle电子商务套件ebs,Oracle电子商务套件EBS(E-Business Suite)研发战略和路线图.ppt...
Oracle电子商务套件EBS(E-Business Suite)研发战略和路线图 Anne – tweaked product names to match price list – applied ...
Entity Framework With Oracle
虽然EF6都快要出来了,但是对于Oracle数据库,仍然只能用DB first和Model First来编程,不能用Code First真是一个很大的遗憾啊. 好了,废话少说,我们来看看EF中是如何用 ...
sql语句查询Oracle|sql server|access 数据库里的所有表名,字段名
Oracle select * from user_tables where table_name = '用户名' 如果是用该用户登录使用以下语句: SELECT * FROM USER_TABLES ...
access mysql oracle数据库_Oracle Access 数据库连接使用
直接代码吧: /// /// Oracle数据库连接 /// /// 数据库连接串,例如:(DESCRIPTION =(ADDRESS_LIST =(ADDRESS = (PROTOCOL = TCP ...

Designing an IAM Framework with Oracle Identity and Access Management Suite[文摘]

Designing an IAM Framework with Oracle Identity and Access Management Suite[文摘]相关推荐

最新文章

热门文章