15

I am setting up a new RESTful web service and I need to provide a role-based access control model. I need to create an architecture that will allow users to provide their username and password to get access to the services and then restrict how they can use the services (which services they can use, read vs read/write, etc) based upon the roles assigned to that users.

I have looked around at other questions and found pieces of what I want. For example there are several great discussions about how to handle passing credentials to REST services restful-authentication, best practices. There are also some great pointers on what programmers should know when creating websites (what every developer should know before building a public web site).

But I haven't been able to find a good post, article, book on best practices and patterns for the software architecture that implements these solutions.

Specifically:

  • How should user details and access rights be stored? (data model, location, format)
  • What are good design patterns for representing and tracking these in the server? (sessions in memory, db lookups each time, etc)
  • What are good patterns for mapping these rights to the services in a secure way in the code base?
  • What architectural choices can help keep the system more secure and reliable?
  • What lessons learned do people have from the trenches?

I am looking for are design patterns and recommendations for the software architecture outside of any specific technologies.

(If the technologies matter, I am planning to implement this using python, twisted, and a postgresql database)

Improve this question
4
  • Sounds like you just need someone to write it for you ;)
    – Martin Blore
    Commented Mar 4, 2011 at 18:08
  • Unfortunately it looks like way. It just seemed odd that this part of the stack was not described anywhere. Even if I could find a writeup of how a site like newegg, digg, or even even stackoverflow handles user credentials and access in the backend, that would help.
    – Allen
    Commented Mar 4, 2011 at 20:36
  • Have you made any progress on this?
    – Bryan Agee
    Commented Aug 1, 2012 at 17:04
  • Have you considered oAuth2? There are server and client libraries available for it in many popular languages that should make it easier to implement it.
    – Sam
    Commented Mar 14, 2014 at 15:14

1 Answer 1

Reset to default
5

OpenAM.

http://forgerock.com/openam.html

How should user details and access rights be stored? (data model, location, format)

Identity Manager. Separate from any web server. LDAP-based.

What are good design patterns for representing and tracking these in the server? (sessions in memory, db lookups each time, etc)

Solved by your framework. Think no more. Just use your framework's already-built good design patterns.

What are good patterns for mapping these rights to the services in a secure way in the code base?

Solved by your framework. Each framework uses a slightly different approach. Each language has slightly different features. Django, for example, uses Python's decorators heavily for this.

What architectural choices can help keep the system more secure and reliable?

More? More than what?

Improve this answer
2
  • In my specific setup I don't think I can use something like OpenAM. I don't need enterprise-wide single sign-on. I think I need something smaller and more self-contained.
    – Allen
    Commented Mar 4, 2011 at 20:34
  • @Allen. We don't use it for enterprise-wide single sign-on. We use it for simple identity management.
    – S.Lott
    Commented Mar 4, 2011 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.