This guide introduces Casbin, an open‑source access‑control framework, explains its supported languages, core features, installation steps, configuration details, and provides practical code examples for integrating Casbin with PHP Webman projects.
The article analyzes reliability governance challenges in Meituan's billion‑traffic systems, introduces pattern mining as a way to uncover common reliability issues, and presents three concrete case studies—idempotency, dependency, and over‑privilege governance—demonstrating how large‑scale traffic data and environment isolation enable low‑cost, automated reliability solutions.
This article explains how to securely expose a MySQL server behind an Nginx stream proxy, covering required modules, configuration directives, IP‑based access control, and complete example setups for both single‑instance and clustered environments.
This article explains how to configure Nginx's stream module to proxy MySQL connections, including building Nginx with the required module, setting up stream, server, and listen directives, and using allow/deny rules to restrict access by IP, followed by a complete configuration example.
This article details the design and development of Baidu's Unified Permission Management Service (MPS), covering requirements analysis, technology selection, architecture, platform and node management, permission models (RBAC, ACL, DAC), functional modules, API integration, audit, and deployment strategies for enterprise-wide access control.
This article details the design and development of a unified permission management service (MPS) that consolidates RBAC, ACL, and DAC models to solve fragmented enterprise permission issues, covering requirement analysis, technical selection, functional modules, deployment, and performance outcomes.
This article presents a comprehensive design and development of Baidu's Unified Permission Management Service (MPS), detailing its requirement analysis, technical selection, hybrid RBAC/ACL/DAC model, functional modules, implementation specifics, and operational results that demonstrate its effectiveness in consolidating enterprise-wide access control.
This guide explains how to use Nginx’s stream module as a jump‑host to securely proxy MySQL connections, covering module compilation, core directives, configuration examples for single and clustered servers, and IP‑based access restrictions to protect database traffic.
This article explains the concept of multi‑tenant Kubernetes clusters, compares soft and hard isolation models, outlines enterprise, SaaS, and KaaS use cases, and provides practical guidance on access control, resource scheduling, and advanced security measures to achieve reliable tenant isolation.
Learn how to safely expose MySQL on a private network by configuring Nginx as a stream proxy, including building the required modules, setting up stream, server, and listen directives, and restricting access with allow/deny rules for specific IP ranges.
Unified Permission Management Service (MPS) at Baidu centralizes fragmented permission systems across internal platforms, integrating ACL, DAC, and RBAC models via Baidu's GDP framework, and provides modules for platform and node management, permission CRUD, workflow approvals, and audit/recovery, now serving over 20,000 users and managing more than 100,000 permission nodes.
This article explores three practical solutions for exposing APIs only to internal services—microservice isolation, a Redis‑based whitelist via the gateway, and a gateway‑plus‑AOP approach—detailing their trade‑offs and providing complete Java code examples for the chosen method.
This article compares OceanBase (MySQL mode) and MySQL in terms of user management, password syntax, user locking, permission levels, grant statements, grant tables, network white‑list access control, row‑level security, and role management, highlighting similarities, differences, and migration considerations.
Cedar is an open‑source, domain‑specific language from Amazon that lets developers define, analyze, and enforce access‑control policies outside application code, supporting RBAC and ABAC, with SDKs for Rust and Java and integration into Amazon Verified Permissions and AWS Verified Access.
This article presents NetEase's practical experience of constructing a big‑data security center using Apache Ranger, covering Ranger's core features, a comprehensive security solution, detailed technical analyses, and the outcomes of commercializing the platform across multiple enterprise environments.
The article explains how cryptographic access control, especially a hybrid‑encrypted Threshold Proxy Re‑Encryption scheme built on national SM2/SM3/SM4 algorithms, offers high‑strength, decentralized, and efficient data authorization and sharing, addressing the limitations of traditional role‑based models.
This article explains the concept of multi‑tenant Kubernetes clusters, outlines common enterprise scenarios such as internal shared clusters and SaaS/KaaS models, and presents practical security and resource‑scheduling techniques—including RBAC, NetworkPolicy, PSP, OPA, and dedicated nodes—to achieve reliable isolation.
This article introduces the DuoliXiong local‑life service platform, analyzes the challenges of permission management across its multi‑layered architecture, and details the design of a flat RBAC model—including business‑line isolation, user, role, and permission tables, tree‑structured permission mapping, and data‑level access controls—to support scalable, secure operations.
The article explains how to create data‑security diagrams that map which participants can access specific enterprise data, recommends breaking large diagrams into role‑based views, and illustrates the approach with UML/BPMN and ArchiMate models while addressing compliance and trust considerations.
This article explains the concepts of functional and data permissions, the advantages of RBAC, and provides a step‑by‑step guide for designing and implementing a SaaS multi‑tenant data scope permission system using Spring Boot, MyBatis Plus, and Vue.
The article outlines Berserker’s comprehensive data‑security framework—built on the CIA triad and 5A methodology—that unifies authentication, authorization, access control, asset protection, and auditing across Hive, Kafka, ClickHouse and ETL tasks, describes the migration from version 1.0 to 2.0 with a redesigned permission system, workspaces, Casbin performance tweaks, and previews future fine‑grained, lifecycle‑wide security enhancements.
This article introduces the DuoliXiong local‑service platform, analyzes the challenges of its multi‑platform permission management, and details the design of a role‑based access control (RBAC) system—including model selection, database schema, tree‑structured permission representation, multi‑business‑line isolation, and data‑level (row/column) permissions—culminating in a scalable solution for complex B‑end and O‑end applications.
This article outlines ByteDance's comprehensive big‑data security framework, detailing current challenges, fine‑grained permission control, asset protection, data deletion capabilities, and the governance principles that balance compliance with operational efficiency.
This article explains Baidu's Duoli Bear permission system, detailing its business context, challenges of multi‑role and platform isolation, and the custom RBAC design that uses a tree‑structured menu, role‑based data rules, and business‑line isolation to manage access across diverse services.
This article explains how to extend the classic Role‑Based Access Control (RBAC) model with fine‑grained data permissions, detailing rule definition, database design, role‑rule binding, and AOP‑based enforcement, and offers optimization tips such as rule groups for complex scenarios.
This article explains how to augment the classic Role‑Based Access Control (RBAC) model with row‑level data permissions, detailing rule definition, database design, role‑rule binding, and an AOP‑based implementation for dynamic SQL filtering.
The article explains why enterprises need a unified account management system, defines key authentication terms, outlines the advantages of token‑based security, describes a complete OAuth2 password‑grant flow with JWT, and presents the technical choices and interface designs for implementing a robust, cross‑service authentication solution.
This article examines traditional RBAC, ABAC, and PBAC access‑control models, evaluates their strengths and weaknesses, and presents a hybrid permission architecture tailored for 微盟's WOS system that combines role‑based and attribute‑based rules to achieve high flexibility and fine‑grained authorization.
This article explains RBAC concepts and model classifications, demonstrates basic Spring Security setup, shows how to configure in‑memory and database authentication, integrates JWT for stateless token‑based access, implements JSON‑based login, and covers password encryption with BCrypt in a Spring Boot backend.
This article explains Dapr's security foundation, covering end‑to‑end mTLS for service invocation, configurable access control policies for services and Pub/Sub components, trust domains, SPIFFE identities, and practical examples of policy configurations and deployment steps for both local and Kubernetes environments.
This article provides a comprehensive tutorial on role‑based access control (RBAC) concepts, model classifications, permission definitions, user‑group usage, and step‑by‑step implementations of Spring Security, JWT integration, JSON login, password encryption, and database authentication with extensive code examples.
This article explains why strict permission management is essential for data security, illustrates various permission models—from basic data-view and edit rights to role‑based access control (RBAC), role inheritance, constraints, user groups, organizations, and positions—and provides practical database table designs for implementing scalable, ideal RBAC systems.
This article explains the design and implementation of a unified data security control platform that protects user privacy and corporate data across multiple big‑data components (Hive, Hetu, GaussDB) by integrating Apache Ranger, custom authorization APIs, asynchronous processing, distributed locking, and SDK‑based authentication to achieve fine‑grained, one‑stop permission management.
This article provides an in‑depth guide to authentication, authorization, and access control, covering basic HTTP authentication, session‑cookie mechanisms, token‑based approaches, JWT structure, single sign‑on (SSO), OAuth 2.0 flows, unique login enforcement, QR‑code login, and one‑click mobile login, with practical code examples and diagrams.
This article explains why permission management is essential, outlines common permission models such as RBAC and its extensions, discusses role inheritance, constraints, user groups, organizations and positions, and presents practical database schema designs for both standard and ideal RBAC systems.
This guide explains why the su command is available to all users by default, then shows how to back up the sudoers file, edit it with visudo, define a command alias to disable /usr/bin/su, and apply the restriction to individual users or entire groups, complete with verification steps.
This article provides a comprehensive overview of Alibaba Cloud MaxCompute, covering its product features, architecture, ecosystem integrations, and in‑depth data security mechanisms such as authentication, RAM roles, access control policies, label‑based security, project protection, audit logging, encryption, backup, disaster recovery, and the complementary DataWorks security capabilities.
This article explains the fundamentals of permission system design, introducing five mainstream access control models—ACL, DAC, MAC, ABAC, and RBAC—detailing their principles, examples, advantages, drawbacks, and practical implementation considerations such as role hierarchy, constraints, and data permissions.
This article introduces the design of permission systems and thoroughly explains the five mainstream access control models—ACL, DAC, MAC, ABAC, and RBAC—along with their principles, examples, drawbacks, and practical implementation details for real‑world applications.
This guide explains why the default SSH configuration on Linux is risky and provides eight concrete hardening measures—including disabling root login, changing the default port, enforcing key‑based authentication, limiting login attempts, and restricting access by IP—to secure your server against common attacks.
This article details Bilibili's implementation of Apache Ranger for fine‑grained access control across Hadoop, HDFS, Hive, Spark, and Presto, covering architecture, API redesign, admin optimizations, gray‑release strategies, permission pre‑checks, data masking, and future plans for incremental policy loading.
Bilibili’s data platform redesigns Ranger‑based access control by simplifying HDFS and Hive policy APIs, parallelizing policy loading, adding gray‑release and pre‑check mechanisms, integrating fine‑grained Hive authorization with data‑masking, extending support to Spark and Presto, and planning incremental loading, policy fusion, and a NameNode proxy to boost security and performance.
This article explains the design of permission systems by introducing five major access control models—ACL, DAC, MAC, ABAC, and RBAC—detailing their principles, examples, advantages, drawbacks, and practical implementation considerations for user, role, and permission management in enterprise applications.
This article describes the challenges of fragmented user management in enterprise applications and presents a unified, standardized account management solution based on token authentication, detailing OAuth2 password flow, JWT usage, system architecture, authorization processes, credential renewal, and interface design for secure, scalable access control.
This article explains the need for a unified account management platform in enterprises, defines key authentication terms, compares session‑based and token‑based approaches, outlines a complete OAuth2 password‑grant flow with JWT tokens, and discusses technical choices, security features, and interface design for modern microservice architectures.
The article describes a PAM‑based jump‑server architecture that securely proxies SSH, RDP, and other terminal access without storing credentials, using stateless micro‑services and a custom jmp.so module on each host to intercept authentication, enforce permission rules, and block dangerous commands.
This article introduces the problems of the legacy permission approach at Zhuanzhuan, compares industry‑standard RBAC and ABAC models, explains the design rationale for a hybrid RBAC‑based system, and outlines the core modules, role hierarchy, and permission types for the new unified permission management platform.
This article explains what a firewall is, how it isolates risk zones from safe zones, its working principles, the typical architecture involving screening routers and proxy servers, and the key security functions it provides for protecting network communications.
This document explains the need for a unified account management system in enterprise cloud platforms, defines key terminology, outlines the advantages of token‑based authentication, describes the OAuth2 password‑grant flow and JWT usage, and details the technical design, interface specifications, and credential renewal process for secure cross‑service access.
The article explains how to design a unified, token‑based authentication system for enterprise applications, covering OAuth2 password grant, JWT usage, token issuance, validation, renewal processes, and interface design, while highlighting the benefits of stateless security and cross‑service single sign‑on.
The article presents a comprehensive case study of the Magic Butler system—a zero‑trust security management solution developed by 58 Group’s TEG department—detailing its business drivers, design principles, architecture, key technical features, deployment scale, and future outlook for enterprise network security.
This article provides a comprehensive analysis of Zero Trust security, explaining its core principles, SDP‑based architecture, various implementation models—including user‑to‑resource and service‑to‑service schemes—deployment options, practical use cases, and guidance for successful enterprise adoption.
This article provides a comprehensive overview of zero‑trust security, explaining its core principles, architectural models such as SDP, various implementation approaches (application‑layer proxy, traffic‑layer proxy, hybrid), deployment patterns for office and multi‑branch environments, practical rollout experience, and how zero‑trust integrates with existing security products.
This article provides a comprehensive overview of zero‑trust security, explaining its core principles, SDP‑based architecture, three main implementation models (application‑layer proxy, traffic‑layer proxy, and hybrid), various deployment scenarios, and practical guidance for enterprise adoption.
This article outlines the design rationale, objectives, and technical choices for a unified, token‑based authentication system based on OAuth2 password grant and JWT, detailing terminology, workflow steps, security benefits, and interface specifications to enable cross‑system single sign‑on and secure access control.
This article explains the necessity of a unified account management system for enterprise applications and details a token‑based authentication solution using OAuth2 password grant and JWT, covering definitions, advantages, workflow steps, technical choices, and interface design for secure microservice integration.
This article traces the evolution from DAC through MAC to RBAC and ABAC, critiques common implementations, and presents a practical, tag‑based permission system that cleanly separates roles, policies, and objects for scalable, secure access control.
This article details the design and implementation of a comprehensive big data permission system that integrates Hive, Presto, Hadoop, and Metabase, covering data access methods, authentication choices, Ranger-based authorization, policy management, and automated workflow integration to balance security and efficiency.
This presentation introduces data security concepts, outlines security goals and the 4A/5A model, describes the data lifecycle, and details practical tools and frameworks for identity authentication, access control, asset protection, and comprehensive governance to ensure secure data handling across its full lifecycle.
This article explains data security fundamentals, the full data lifecycle, the 4A/5A security model, trust‑level goals, and a comprehensive tool framework covering identity authentication, permission control, asset protection, and governance strategies to protect data throughout its lifecycle.
This article describes the evolution from an unsecured data warehouse to a comprehensive big‑data access control system at BanYu, detailing the background, data access methods, design goals, authentication and authorization mechanisms, policy configuration, integration with Metabase, and the overall workflow that balances security with efficiency.
This article explains a dynamic permission management solution for modern frontend‑backend separated applications, detailing user‑role‑page‑function relationships, database schema design, menu rendering, fine‑grained function controls, and backend API authorization to handle flexible, real‑time access rights.
This article describes the background, design goals, authentication and authorization mechanisms, system architecture, policy configuration, and Metabase integration of BanYu's big data permission system, highlighting how it balances security and efficiency across Hive, Presto, HDFS, and other components.
This article describes the background, design goals, authentication and authorization mechanisms, system architecture, policy configuration, and Metabase integration of Banyu's big data permission system, which secures Hive, Presto, HDFS and other data access components using Apache Ranger and LDAP.
This article explains how to implement a flexible, database‑driven permission system that manages users, roles, pages, functions, and API access in modern front‑end/back‑end separated applications, ensuring secure and dynamic access control across the entire stack.
After adopting OAuth2.0, the added concept of scope often confuses developers; this article clarifies the differences between scope and role, explains how each controls access, shows Spring Security code examples, and highlights their complementary relationship in securing APIs.
This article explains firewalls by defining their purpose, describing how they monitor and filter network traffic, outlining their architecture—including screening routers and proxy servers—and listing their key security functions such as access control, traffic filtering, logging, and attack detection.
This article analyzes various client scenarios in multi‑client information systems, categorizes authentication tokens (password, session, API, access, PAM, MAP), compares their natural and controllable attributes, proposes a hierarchical token architecture, and discusses security, privacy, and practical application considerations.
This article explains what a Keycloak Realm is, when to use it, the role of the built‑in Master Realm, how to create and manage additional Realms, and practical methods for setting up Realm‑specific admin accounts using both Master users and realm client users.
This article analyzes various token‑based authentication methods across multiple client scenarios, categorizes tokens into password, session, and API types, compares their natural and controllable attributes, outlines hierarchical relationships, and offers design guidelines to improve security, privacy, and usability in multi‑client systems.
This article explains the fundamentals of permission management, detailing RBAC models, user‑role‑permission relationships, organization and position structures, authorization workflows, database schema design, and popular security frameworks for building robust backend access control systems.
This article analyses various client‑side authentication scenarios, classifies token types such as password, session, and API tokens, compares their cost, risk, and controllable attributes, and proposes a layered token architecture to improve security, privacy, and usability across multiple platforms.
This article outlines the limitations of traditional perimeter‑based IT security, introduces the Zero Trust philosophy and its six core principles, and presents a practical, layered architecture with components and prioritized steps for building a Zero Trust network in modern enterprises.
This article explains the fundamentals of permission management, detailing the classic RBAC0 model and its extensions RBAC1‑RBAC3, and explores how roles, users, groups, organizations, and positions interrelate in both single‑system and distributed micro‑service architectures, including practical table designs and framework options.
The article explains SELinux’s origins, core architecture, mandatory access control mechanisms such as type enforcement and MLS, and how Android incorporates SELinux as SEAndroid—detailing its evolution from permissive to enforcing mode, policy file structure, Android O’s split policies, and example domain and object transitions.
This article analyzes various client scenarios in multi‑client systems, classifies authentication tokens into password, session, and interface categories, compares their natural and controllable attributes, and proposes a layered token hierarchy to improve security, privacy, and usability across web, mobile, and API platforms.
This article analyzes various authentication token types, their usage scenarios across web, mobile, and API clients, compares their natural and controllable attributes, proposes a hierarchical token model, and offers security guidelines for designing a robust multi‑client identity verification system.
This guide shows how to install PHP‑Casbin, configure an RBAC model, initialize an enforcer with a MySQL adapter, add roles and permissions, and verify access decisions for different users using concrete code examples.
Learn comprehensive MySQL security strategies covering storage RAID configurations, network whitelisting, OS hardening, account management, privilege restrictions, audit logging, regular backups, data encryption, and disaster recovery to protect enterprise data against breaches and ensure stable, high‑performance operations.
This article analyzes token‑based identity authentication in multi‑client information systems, classifies various token types, compares their natural and controllable attributes, and proposes a hierarchical token architecture that balances security, usability, and lifecycle management across web, mobile, and API scenarios.
This article provides a comprehensive tutorial on Zookeeper 3.5.10, covering client and server commands, node attributes, creation, querying, updating, deletion, listing children, checking node status, watcher usage, and detailed access control mechanisms with practical command examples.
This guide explains how to use PHP‑Casbin to enforce attribute‑based access control (ABAC) by defining request, policy, and matcher sections, creating attribute‑rich objects, and calling the enforcer to obtain true or false decisions for different subjects and resources.
This article explains what Casbin is, how its PERM model works, and provides a step‑by‑step guide to integrate Casbin’s RBAC authorization into a Go project using Gin, Gorm, and a MySQL adapter, including model configuration, policy storage, middleware enforcement, and verification.
This article examines the evolution of Youzan's permission management—from the original SAM system using a 64‑bit RBAC model to the flexible 2.0 architecture with rig, dynamic menu, and widget delegation—highlighting design choices, implementation details, challenges solved, and measurable business impact.
Casbin is an open‑source access‑control framework that supports multiple programming languages, offers customizable request formats, role inheritance, super‑user shortcuts, and built‑in matchers, while delegating authentication and user management to other components.
This article explains Apache Ranger's role as a centralized security framework for Hadoop, detailing its key features, architecture, policy workflow, practical administration examples, and how to automate bulk policy management with Java and REST APIs.
This article explains the fundamental differences between JSON Web Tokens (JWT) and OAuth 2.0, outlines their structures, roles, and grant types, compares implementation effort and risk, and provides guidance on choosing the right approach for various API security scenarios.
This guide explains how to use Nginx configuration directives to deny execution of uploaded scripts, block access to specific file types and directories, return custom HTTP status codes, and limit access by client IP to improve web server security.
This article explains the concept, purpose, design principles, core features, authentication methods, deployment options, and popular open‑source and commercial solutions of bastion hosts, highlighting how they centralize access control, audit operations, and improve overall IT security and compliance.
This article introduces Apache Shiro, a lightweight Java security framework, covering its authentication, authorization, cryptography, session management, core components, module functions, and overall architecture to help developers grasp its practical use in permission management.
This article outlines essential security practices for handling file uploads, including type whitelisting, safe filename generation, checksum verification, size limits, access restrictions, and audit logging, helping developers prevent common vulnerabilities and protect their systems.
This article explains how SELinux enforces mandatory access control on Linux, describes its three modes, shows how to view and modify SELinux contexts for MySQL processes and data directories, and provides step‑by‑step commands to add custom paths, logs, PID files, and ports while preserving system security.
This article explains why permission systems are essential, introduces the RBAC model and its variants, outlines its key characteristics, and guides you through designing a basic role‑based access control system with practical examples and diagrams.
This article analyzes token-based identity authentication in multi‑client information systems, classifies various token types, compares their natural and controllable attributes, proposes a four‑layer hierarchy, and discusses practical usage scenarios and design principles to improve security and privacy.
This article analyzes various client scenarios in modern information systems, categorizes authentication tokens, compares their natural and controllable attributes, proposes a hierarchical token model, and outlines best‑practice principles to achieve secure, privacy‑preserving identity verification across web, mobile, and API platforms.
Following a massive ransomware breach that encrypted thousands of servers and stole sensitive data, this guide outlines four essential self‑check steps—data backup, encryption, server permission management, and platform user access control—along with JD Cloud’s concrete best‑practice actions to harden your infrastructure.
This article analyzes various authentication token categories, their natural and controllable attributes, hierarchical relationships, and practical usage scenarios across web, mobile, and API clients, offering a structured approach to improve security, privacy, and manageability in multi‑client information systems.
The article explains how the vague term “user” creates design flaws and security vulnerabilities across domains such as airline booking systems, Unix environments, and SaaS platforms, and argues for precise terminology to avoid costly rework and confused‑deputy attacks.
This guide explains how to use Nginx directives to deny execution of uploaded script files, block specific file types, restrict directory access, and limit client IPs, thereby strengthening website security for user‑facing services.
An in‑depth guide explains what a bastion host is, its 4A design (authentication, authorization, account, audit), core functions, common deployment models, authentication methods, and both commercial and open‑source options, highlighting how it centralizes control, enhances security, and streamlines operational compliance.
