在SaaS环境中使用客户端密钥的最佳做法(Best practice to make use of Client Secret Key in SaaS environment)

 当全新客户端获得注册并存储在数据库列（对其有唯一约束 ）时， Asp.NET Web API会生成一个秘密密钥 （ 使用32个字符长的对称算法 ）。 在整个过程中，客户端必须在授权标头中提供密钥才能访问自己的资源（ 多租户SaaS环境 ）。 目前不需要访问令牌。 期望客户端密钥的主要原因是从数据库中过滤并提供适当的数据！ 
 
 我认为在WHERE子句中使用ClientSecretKey从SQL表中获取客户端数据不会对性能友好，例如： 
 
 SELECT Multiple_Columns from ClientTable WHERE ClientSecretKey='X3i1aBer' 
 
 理想情况下，我宁愿使用在表中定义为IDENTITY列的ClientId来获取客户端记录。 
 
 问题： 
 
 
 
 如何最好地设计一个唯一的客户端密钥，在对数据库执行查询以获取特定的客户端记录时，该密钥应该绝对性能友好？ 
 
 
 我的想法或设计中是否有缺陷？ 
 
 
 任何想法都会非常感谢。 
 
 谢谢！ 

The Asp.NET Web API generates a Secret Key (using Symmetric Algorithm 32 characters long) when a brand new client gets registered which is stored in a database column (has unique constraint on it). Throughout, the API usage a client must provide the Secret Key in an Authorization header in order to access the it's own resources (Multi-Tenant SaaS environment). There is no requirement for Access Token at the moment. The main reason of expecting Client Secret Key is to filter and deliver an appropriate data from the database!
 
I think fetching Client Data from SQL Table using the ClientSecretKey in a WHERE clause is not going to be performance friendly, for an example:
 
SELECT Multiple_Columns from ClientTable WHERE ClientSecretKey='X3i1aBer' 
 
Ideally, I would prefer to fetch the client records using ClientId which is defined as an IDENTITY column in a table.
 
Questions:
 
 
 
How best to design a Unique Client Key that should be absolutely performance friendly when executing the query against database to fetch that specific client records?
 
 
Is there any flaw in my thinking or the design?
 
 
Any ideas would be REALLY appreciated.
 
Thanks!

原文：https://stackoverflow.com/questions/34417742