摘要
南水北调中线干线工程建设管理信息系统是我国水利建设最重要的信息系统。其中,南水北调用户管理是对南水北调中所有用户、资源进行权限配置管理最重要的部分之一。南水北调信息系统涉及大量的子系统资源,每个子系统又包含大量的系统用户,并且还具有大量的建设管理用户,每个用户对不同的系统资源具有不同的管理权限。如何方便的为每个用户分配资源,并对相应的资源分配合理的操作权限是整个信息系统建设中的一个难题。由于系统资源及用户的繁多、复杂性,如何提出一个合理的方案,使得系统对每个用户请求都能够作出一个十分快速的反应,尽量减少延迟也显得十分重要。本文提出了一种基于LDAP的、二级鉴权的用户管理机制,为整个门户和各个子系统分别设计一个管理系统,实现门户用户管理控制子系统用户管理,子系统用户管理控制用户资源权限的二级映射结构,并考虑数据的高并发性,使用了LDAP+数据库的数据存储方式,将用户经常需要修改的信息存储在Oracle数据库,而较少修改,经常查询的信息存储在LDAP服务器中,充分利用了LDAP服务器的高查询性,极大的提高了系统对用户的响应效率,出色的满足了用户需求。
NSBD is one of the most important information management systems. Among them the user management system is the most important part, which made a well deployment for all users and resource to make sure that every user was reasonable privilege in resources. NSBD information system contains large amount of subsystem resources. Each subsystem not only contains their own system-users, but also some other construction management users. So it is a tough problem to reasonably allocate the system resource and the corresponding privilege to each user. Furthermore, because of the large numbers and complicated structure of system resources, a quick response for each user＇s request is also a very important fact. This paper issued a solution which can perfectly resolve these problems and meet the needs of users capably. It is a user management mechanism that is based on LDAP with two-stage privilege control, respectively de- signed management mechanisms for the portal and all subsystem to ensure the portal＇s controlling subsystem, and subsystems＇ controlling on the detailed resources. Furthermore, considering the data concurrency, we presented a brand data-storing style, LDAP and Database , the data which need frequently modifying will he stored in Oracle Database, but some others will be stored in the server of LDAP, which is well-known for its quick response to query.
出处
《水资源与水工程学报》
2008年第6期14-19,共6页
Journal of Water Resources and Water Engineering
基金
"十一五"国家科技支撑计划重大项目(2006BAB04A13)
关键词
南水北调
用户管理系统
资源权限分配
二级鉴权LDAP
South-to-North Water Division
management information system of user
allocation of resources privilege
two-stage privilege controlling LDAP
