This article explains how to protect Nacos configuration data by applying zero‑trust principles, covering transport encryption with TLS, storage encryption using plugins, and fine‑grained access control through authentication and RBAC, while providing practical configuration steps.
This article explains the motivations behind RocketMQ ACL 2.0, outlines its six major enhancements—including fine‑grained API permissions, flexible matching modes, and cluster‑wide access control—details the RBAC/ABAC model, authentication and authorization workflows, configuration examples, command‑line usage, and migration strategies, and discusses future planning for the access control system.
This article explains how to manage Jenkins deployment permissions using RBAC and the Role‑Based Authorization Strategy plugin, covering RBAC fundamentals, plugin installation, creating users, jobs, groups, roles, and assigning permissions to ensure secure and organized pipeline access.
This article explains why permission management is essential for data security, describes various permission models including classic RBAC, role inheritance, constrained RBAC, and discusses practical extensions such as user groups, organizations, positions, and provides database schema designs for both standard and ideal RBAC implementations.
This tutorial explains RBAC concepts and model classifications, demonstrates permission and user‑group management, and provides step‑by‑step guidance for implementing Spring Security with in‑memory authentication, JWT integration, JSON login, password encryption, and database authentication using Java code examples.
The article explains how granting ordinary MySQL users full access to authentication tables can lead to severe privilege‑escalation risks, demonstrates the issue with concrete scenarios, and provides mitigation strategies including the use of MySQL 8.0 partial revokes and the principle of least privilege.
The article explains the necessity of strict permission management in enterprises, introduces various permission models such as basic RBAC, role‑inheritance RBAC and constrained RBAC, and provides detailed table designs and best‑practice recommendations for implementing scalable and secure access control systems.
This article explains Linux's read, write, and execute permissions for files and directories, analyzes the scenario where a user has read access to a file but lacks execute (and read) rights on its parent directory, and concludes that directory execute permission is essential for file access.
This article outlines the background, importance, scenarios, challenges, objectives, and architectural design—including RBAC and ABAC models, metadata integration, data classification, and verification mechanisms—of a comprehensive big data permission management system for secure and fine‑grained data access.
This guide explains how to secure Linux servers by configuring sshd to allow or deny specific users or IPs, using hosts.allow/hosts.deny for IP filtering, and setting up iptables rules to open only required ports while blocking all others.
The article explains why strict permission management is essential, walks through classic RBAC, role inheritance, constraint handling, user groups, organization and position mapping, and presents both standard and ideal database schemas for building maintainable access‑control systems in complex enterprises.
This article explains the principles, examples, and drawbacks of the five mainstream access‑control models—ACL, DAC, MAC, ABAC, and RBAC—while also detailing RBAC extensions and practical guidelines for designing user, role, and permission management in real‑world systems.
This article explains Kubernetes RBAC fundamentals, walks through role, role binding, and service account configurations with code examples, describes the authentication‑authorization‑access flow, and offers practical best‑practice recommendations for secure, maintainable cluster access control.
The article presents a practical permission‑management strategy for a large‑scale front‑end monorepo that merges Git‑hook validation with GitLab’s protected branches and role‑based access, defines a clear directory hierarchy, outlines workflow controls, and explores extensions such as fine‑grained ACLs and file‑access logging to prevent unauthorized file changes.
This guide explains how to use Burp Suite's Auth Analyzer plugin to efficiently perform bulk API access‑control (broken access control) testing, covering vulnerability types, tool installation, step‑by‑step testing procedures, result analysis, and report export for improved software security.
This article explains the challenges of data permission control in multi‑system environments, outlines a unified RBAC‑based model with extensible dimensions, and provides a step‑by‑step integration guide and SDK implementation for Java backends, including code snippets and practical considerations.
This article describes a unified, configurable data‑permission framework built on RBAC, detailing its architecture, rule definition, integration workflow, Java SDK implementation, and practical examples to achieve flexible, low‑coupling access control across multiple backend systems.
This article walks through DuoLiXiong’s three‑layer business architecture, identifies the challenges of managing permissions across dozens of platforms, explains the RBAC fundamentals and four model variants, details the concrete database schema and tree‑structured permission design, and explores row‑ and column‑level data permissions with practical examples.
This article explains the fundamentals of Role‑Based Access Control (RBAC), its model variants, permission concepts, and user‑group usage, then demonstrates practical Spring Security setups ranging from simple in‑memory authentication to JWT integration, JSON‑based login, password encryption, and database‑backed authentication with full code examples.
This article explains how to secure PHP APIs by implementing a signature mechanism and rate‑limiting using Redis, and also outlines additional protections such as HTTPS, access control, input validation, logging, and security audits.
This guide introduces Casbin, an open‑source access‑control framework, explains its supported languages, core features, installation steps, configuration details, and provides practical code examples for integrating Casbin with PHP Webman projects.
The article analyzes reliability governance challenges in Meituan's billion‑traffic systems, introduces pattern mining as a way to uncover common reliability issues, and presents three concrete case studies—idempotency, dependency, and over‑privilege governance—demonstrating how large‑scale traffic data and environment isolation enable low‑cost, automated reliability solutions.
This article explains how to securely expose a MySQL server behind an Nginx stream proxy, covering required modules, configuration directives, IP‑based access control, and complete example setups for both single‑instance and clustered environments.
This article explains how to configure Nginx's stream module to proxy MySQL connections, including building Nginx with the required module, setting up stream, server, and listen directives, and using allow/deny rules to restrict access by IP, followed by a complete configuration example.
This article details the design and development of Baidu's Unified Permission Management Service (MPS), covering requirements analysis, technology selection, architecture, platform and node management, permission models (RBAC, ACL, DAC), functional modules, API integration, audit, and deployment strategies for enterprise-wide access control.
This article details the design and development of a unified permission management service (MPS) that consolidates RBAC, ACL, and DAC models to solve fragmented enterprise permission issues, covering requirement analysis, technical selection, functional modules, deployment, and performance outcomes.
This article presents a comprehensive design and development of Baidu's Unified Permission Management Service (MPS), detailing its requirement analysis, technical selection, hybrid RBAC/ACL/DAC model, functional modules, implementation specifics, and operational results that demonstrate its effectiveness in consolidating enterprise-wide access control.
This guide explains how to use Nginx’s stream module as a jump‑host to securely proxy MySQL connections, covering module compilation, core directives, configuration examples for single and clustered servers, and IP‑based access restrictions to protect database traffic.
This article explains the concept of multi‑tenant Kubernetes clusters, compares soft and hard isolation models, outlines enterprise, SaaS, and KaaS use cases, and provides practical guidance on access control, resource scheduling, and advanced security measures to achieve reliable tenant isolation.
Learn how to safely expose MySQL on a private network by configuring Nginx as a stream proxy, including building the required modules, setting up stream, server, and listen directives, and restricting access with allow/deny rules for specific IP ranges.
Unified Permission Management Service (MPS) at Baidu centralizes fragmented permission systems across internal platforms, integrating ACL, DAC, and RBAC models via Baidu's GDP framework, and provides modules for platform and node management, permission CRUD, workflow approvals, and audit/recovery, now serving over 20,000 users and managing more than 100,000 permission nodes.
This article explores three practical solutions for exposing APIs only to internal services—microservice isolation, a Redis‑based whitelist via the gateway, and a gateway‑plus‑AOP approach—detailing their trade‑offs and providing complete Java code examples for the chosen method.
This article compares OceanBase (MySQL mode) and MySQL in terms of user management, password syntax, user locking, permission levels, grant statements, grant tables, network white‑list access control, row‑level security, and role management, highlighting similarities, differences, and migration considerations.
Cedar is an open‑source, domain‑specific language from Amazon that lets developers define, analyze, and enforce access‑control policies outside application code, supporting RBAC and ABAC, with SDKs for Rust and Java and integration into Amazon Verified Permissions and AWS Verified Access.
This article presents NetEase's practical experience of constructing a big‑data security center using Apache Ranger, covering Ranger's core features, a comprehensive security solution, detailed technical analyses, and the outcomes of commercializing the platform across multiple enterprise environments.
The article explains how cryptographic access control, especially a hybrid‑encrypted Threshold Proxy Re‑Encryption scheme built on national SM2/SM3/SM4 algorithms, offers high‑strength, decentralized, and efficient data authorization and sharing, addressing the limitations of traditional role‑based models.
This article explains the concept of multi‑tenant Kubernetes clusters, outlines common enterprise scenarios such as internal shared clusters and SaaS/KaaS models, and presents practical security and resource‑scheduling techniques—including RBAC, NetworkPolicy, PSP, OPA, and dedicated nodes—to achieve reliable isolation.
This article introduces the DuoliXiong local‑life service platform, analyzes the challenges of permission management across its multi‑layered architecture, and details the design of a flat RBAC model—including business‑line isolation, user, role, and permission tables, tree‑structured permission mapping, and data‑level access controls—to support scalable, secure operations.
The article explains how to create data‑security diagrams that map which participants can access specific enterprise data, recommends breaking large diagrams into role‑based views, and illustrates the approach with UML/BPMN and ArchiMate models while addressing compliance and trust considerations.
This article explains the concepts of functional and data permissions, the advantages of RBAC, and provides a step‑by‑step guide for designing and implementing a SaaS multi‑tenant data scope permission system using Spring Boot, MyBatis Plus, and Vue.
The article outlines Berserker’s comprehensive data‑security framework—built on the CIA triad and 5A methodology—that unifies authentication, authorization, access control, asset protection, and auditing across Hive, Kafka, ClickHouse and ETL tasks, describes the migration from version 1.0 to 2.0 with a redesigned permission system, workspaces, Casbin performance tweaks, and previews future fine‑grained, lifecycle‑wide security enhancements.
This article introduces the DuoliXiong local‑service platform, analyzes the challenges of its multi‑platform permission management, and details the design of a role‑based access control (RBAC) system—including model selection, database schema, tree‑structured permission representation, multi‑business‑line isolation, and data‑level (row/column) permissions—culminating in a scalable solution for complex B‑end and O‑end applications.
This article outlines ByteDance's comprehensive big‑data security framework, detailing current challenges, fine‑grained permission control, asset protection, data deletion capabilities, and the governance principles that balance compliance with operational efficiency.
This article explains Baidu's Duoli Bear permission system, detailing its business context, challenges of multi‑role and platform isolation, and the custom RBAC design that uses a tree‑structured menu, role‑based data rules, and business‑line isolation to manage access across diverse services.
This article explains how to extend the classic Role‑Based Access Control (RBAC) model with fine‑grained data permissions, detailing rule definition, database design, role‑rule binding, and AOP‑based enforcement, and offers optimization tips such as rule groups for complex scenarios.
This article explains how to augment the classic Role‑Based Access Control (RBAC) model with row‑level data permissions, detailing rule definition, database design, role‑rule binding, and an AOP‑based implementation for dynamic SQL filtering.
The article explains why enterprises need a unified account management system, defines key authentication terms, outlines the advantages of token‑based security, describes a complete OAuth2 password‑grant flow with JWT, and presents the technical choices and interface designs for implementing a robust, cross‑service authentication solution.
This article examines traditional RBAC, ABAC, and PBAC access‑control models, evaluates their strengths and weaknesses, and presents a hybrid permission architecture tailored for 微盟's WOS system that combines role‑based and attribute‑based rules to achieve high flexibility and fine‑grained authorization.
This article explains RBAC concepts and model classifications, demonstrates basic Spring Security setup, shows how to configure in‑memory and database authentication, integrates JWT for stateless token‑based access, implements JSON‑based login, and covers password encryption with BCrypt in a Spring Boot backend.
This article explains Dapr's security foundation, covering end‑to‑end mTLS for service invocation, configurable access control policies for services and Pub/Sub components, trust domains, SPIFFE identities, and practical examples of policy configurations and deployment steps for both local and Kubernetes environments.
This article provides a comprehensive tutorial on role‑based access control (RBAC) concepts, model classifications, permission definitions, user‑group usage, and step‑by‑step implementations of Spring Security, JWT integration, JSON login, password encryption, and database authentication with extensive code examples.
This article explains why strict permission management is essential for data security, illustrates various permission models—from basic data-view and edit rights to role‑based access control (RBAC), role inheritance, constraints, user groups, organizations, and positions—and provides practical database table designs for implementing scalable, ideal RBAC systems.
This article explains the design and implementation of a unified data security control platform that protects user privacy and corporate data across multiple big‑data components (Hive, Hetu, GaussDB) by integrating Apache Ranger, custom authorization APIs, asynchronous processing, distributed locking, and SDK‑based authentication to achieve fine‑grained, one‑stop permission management.
This article provides an in‑depth guide to authentication, authorization, and access control, covering basic HTTP authentication, session‑cookie mechanisms, token‑based approaches, JWT structure, single sign‑on (SSO), OAuth 2.0 flows, unique login enforcement, QR‑code login, and one‑click mobile login, with practical code examples and diagrams.
This article explains why permission management is essential, outlines common permission models such as RBAC and its extensions, discusses role inheritance, constraints, user groups, organizations and positions, and presents practical database schema designs for both standard and ideal RBAC systems.
This guide explains why the su command is available to all users by default, then shows how to back up the sudoers file, edit it with visudo, define a command alias to disable /usr/bin/su, and apply the restriction to individual users or entire groups, complete with verification steps.
This article provides a comprehensive overview of Alibaba Cloud MaxCompute, covering its product features, architecture, ecosystem integrations, and in‑depth data security mechanisms such as authentication, RAM roles, access control policies, label‑based security, project protection, audit logging, encryption, backup, disaster recovery, and the complementary DataWorks security capabilities.
This article explains the fundamentals of permission system design, introducing five mainstream access control models—ACL, DAC, MAC, ABAC, and RBAC—detailing their principles, examples, advantages, drawbacks, and practical implementation considerations such as role hierarchy, constraints, and data permissions.
This article introduces the design of permission systems and thoroughly explains the five mainstream access control models—ACL, DAC, MAC, ABAC, and RBAC—along with their principles, examples, drawbacks, and practical implementation details for real‑world applications.
This guide explains why the default SSH configuration on Linux is risky and provides eight concrete hardening measures—including disabling root login, changing the default port, enforcing key‑based authentication, limiting login attempts, and restricting access by IP—to secure your server against common attacks.
This article details Bilibili's implementation of Apache Ranger for fine‑grained access control across Hadoop, HDFS, Hive, Spark, and Presto, covering architecture, API redesign, admin optimizations, gray‑release strategies, permission pre‑checks, data masking, and future plans for incremental policy loading.
Bilibili’s data platform redesigns Ranger‑based access control by simplifying HDFS and Hive policy APIs, parallelizing policy loading, adding gray‑release and pre‑check mechanisms, integrating fine‑grained Hive authorization with data‑masking, extending support to Spark and Presto, and planning incremental loading, policy fusion, and a NameNode proxy to boost security and performance.
This article explains the design of permission systems by introducing five major access control models—ACL, DAC, MAC, ABAC, and RBAC—detailing their principles, examples, advantages, drawbacks, and practical implementation considerations for user, role, and permission management in enterprise applications.
This article describes the challenges of fragmented user management in enterprise applications and presents a unified, standardized account management solution based on token authentication, detailing OAuth2 password flow, JWT usage, system architecture, authorization processes, credential renewal, and interface design for secure, scalable access control.
This article explains the need for a unified account management platform in enterprises, defines key authentication terms, compares session‑based and token‑based approaches, outlines a complete OAuth2 password‑grant flow with JWT tokens, and discusses technical choices, security features, and interface design for modern microservice architectures.
The article describes a PAM‑based jump‑server architecture that securely proxies SSH, RDP, and other terminal access without storing credentials, using stateless micro‑services and a custom jmp.so module on each host to intercept authentication, enforce permission rules, and block dangerous commands.
This article introduces the problems of the legacy permission approach at Zhuanzhuan, compares industry‑standard RBAC and ABAC models, explains the design rationale for a hybrid RBAC‑based system, and outlines the core modules, role hierarchy, and permission types for the new unified permission management platform.
This article explains what a firewall is, how it isolates risk zones from safe zones, its working principles, the typical architecture involving screening routers and proxy servers, and the key security functions it provides for protecting network communications.
This document explains the need for a unified account management system in enterprise cloud platforms, defines key terminology, outlines the advantages of token‑based authentication, describes the OAuth2 password‑grant flow and JWT usage, and details the technical design, interface specifications, and credential renewal process for secure cross‑service access.
The article explains how to design a unified, token‑based authentication system for enterprise applications, covering OAuth2 password grant, JWT usage, token issuance, validation, renewal processes, and interface design, while highlighting the benefits of stateless security and cross‑service single sign‑on.
The article presents a comprehensive case study of the Magic Butler system—a zero‑trust security management solution developed by 58 Group’s TEG department—detailing its business drivers, design principles, architecture, key technical features, deployment scale, and future outlook for enterprise network security.
This article provides a comprehensive analysis of Zero Trust security, explaining its core principles, SDP‑based architecture, various implementation models—including user‑to‑resource and service‑to‑service schemes—deployment options, practical use cases, and guidance for successful enterprise adoption.
This article provides a comprehensive overview of zero‑trust security, explaining its core principles, architectural models such as SDP, various implementation approaches (application‑layer proxy, traffic‑layer proxy, hybrid), deployment patterns for office and multi‑branch environments, practical rollout experience, and how zero‑trust integrates with existing security products.
This article provides a comprehensive overview of zero‑trust security, explaining its core principles, SDP‑based architecture, three main implementation models (application‑layer proxy, traffic‑layer proxy, and hybrid), various deployment scenarios, and practical guidance for enterprise adoption.
This article outlines the design rationale, objectives, and technical choices for a unified, token‑based authentication system based on OAuth2 password grant and JWT, detailing terminology, workflow steps, security benefits, and interface specifications to enable cross‑system single sign‑on and secure access control.
This article explains the necessity of a unified account management system for enterprise applications and details a token‑based authentication solution using OAuth2 password grant and JWT, covering definitions, advantages, workflow steps, technical choices, and interface design for secure microservice integration.
This article traces the evolution from DAC through MAC to RBAC and ABAC, critiques common implementations, and presents a practical, tag‑based permission system that cleanly separates roles, policies, and objects for scalable, secure access control.
This article details the design and implementation of a comprehensive big data permission system that integrates Hive, Presto, Hadoop, and Metabase, covering data access methods, authentication choices, Ranger-based authorization, policy management, and automated workflow integration to balance security and efficiency.
This presentation introduces data security concepts, outlines security goals and the 4A/5A model, describes the data lifecycle, and details practical tools and frameworks for identity authentication, access control, asset protection, and comprehensive governance to ensure secure data handling across its full lifecycle.
This article explains data security fundamentals, the full data lifecycle, the 4A/5A security model, trust‑level goals, and a comprehensive tool framework covering identity authentication, permission control, asset protection, and governance strategies to protect data throughout its lifecycle.
This article describes the evolution from an unsecured data warehouse to a comprehensive big‑data access control system at BanYu, detailing the background, data access methods, design goals, authentication and authorization mechanisms, policy configuration, integration with Metabase, and the overall workflow that balances security with efficiency.
This article explains a dynamic permission management solution for modern frontend‑backend separated applications, detailing user‑role‑page‑function relationships, database schema design, menu rendering, fine‑grained function controls, and backend API authorization to handle flexible, real‑time access rights.
This article describes the background, design goals, authentication and authorization mechanisms, system architecture, policy configuration, and Metabase integration of BanYu's big data permission system, highlighting how it balances security and efficiency across Hive, Presto, HDFS, and other components.
This article describes the background, design goals, authentication and authorization mechanisms, system architecture, policy configuration, and Metabase integration of Banyu's big data permission system, which secures Hive, Presto, HDFS and other data access components using Apache Ranger and LDAP.
This article explains how to implement a flexible, database‑driven permission system that manages users, roles, pages, functions, and API access in modern front‑end/back‑end separated applications, ensuring secure and dynamic access control across the entire stack.
After adopting OAuth2.0, the added concept of scope often confuses developers; this article clarifies the differences between scope and role, explains how each controls access, shows Spring Security code examples, and highlights their complementary relationship in securing APIs.
This article explains firewalls by defining their purpose, describing how they monitor and filter network traffic, outlining their architecture—including screening routers and proxy servers—and listing their key security functions such as access control, traffic filtering, logging, and attack detection.
This article analyzes various client scenarios in multi‑client information systems, categorizes authentication tokens (password, session, API, access, PAM, MAP), compares their natural and controllable attributes, proposes a hierarchical token architecture, and discusses security, privacy, and practical application considerations.
This article explains what a Keycloak Realm is, when to use it, the role of the built‑in Master Realm, how to create and manage additional Realms, and practical methods for setting up Realm‑specific admin accounts using both Master users and realm client users.
This article analyzes various token‑based authentication methods across multiple client scenarios, categorizes tokens into password, session, and API types, compares their natural and controllable attributes, outlines hierarchical relationships, and offers design guidelines to improve security, privacy, and usability in multi‑client systems.
This article explains the fundamentals of permission management, detailing RBAC models, user‑role‑permission relationships, organization and position structures, authorization workflows, database schema design, and popular security frameworks for building robust backend access control systems.
This article analyses various client‑side authentication scenarios, classifies token types such as password, session, and API tokens, compares their cost, risk, and controllable attributes, and proposes a layered token architecture to improve security, privacy, and usability across multiple platforms.
This article outlines the limitations of traditional perimeter‑based IT security, introduces the Zero Trust philosophy and its six core principles, and presents a practical, layered architecture with components and prioritized steps for building a Zero Trust network in modern enterprises.
This article explains the fundamentals of permission management, detailing the classic RBAC0 model and its extensions RBAC1‑RBAC3, and explores how roles, users, groups, organizations, and positions interrelate in both single‑system and distributed micro‑service architectures, including practical table designs and framework options.
The article explains SELinux’s origins, core architecture, mandatory access control mechanisms such as type enforcement and MLS, and how Android incorporates SELinux as SEAndroid—detailing its evolution from permissive to enforcing mode, policy file structure, Android O’s split policies, and example domain and object transitions.
This article analyzes various client scenarios in multi‑client systems, classifies authentication tokens into password, session, and interface categories, compares their natural and controllable attributes, and proposes a layered token hierarchy to improve security, privacy, and usability across web, mobile, and API platforms.
This article analyzes various authentication token types, their usage scenarios across web, mobile, and API clients, compares their natural and controllable attributes, proposes a hierarchical token model, and offers security guidelines for designing a robust multi‑client identity verification system.
This guide shows how to install PHP‑Casbin, configure an RBAC model, initialize an enforcer with a MySQL adapter, add roles and permissions, and verify access decisions for different users using concrete code examples.
Learn comprehensive MySQL security strategies covering storage RAID configurations, network whitelisting, OS hardening, account management, privilege restrictions, audit logging, regular backups, data encryption, and disaster recovery to protect enterprise data against breaches and ensure stable, high‑performance operations.
This article analyzes token‑based identity authentication in multi‑client information systems, classifies various token types, compares their natural and controllable attributes, and proposes a hierarchical token architecture that balances security, usability, and lifecycle management across web, mobile, and API scenarios.
