I developed many applications with registered user access for my enterprise clients. In many years I have changed my way of doing it, specially because I used many programming languages and database types along time.

Some of them not very simple as view, create and/or edit permissions for each module in the application, or light as access or can't access certain module.

But now that I am developing a very extensive application with many modules and many kinds of users to access them, I was wondering if there is an standard model for doing it, because I already see that's the simple or the light way won't be enough.

  • While I can't say if it is a standard or not, role based access control is something I have seen advocated (PCI compliance documentation comes to mind).
    – Mike
    Jul 1, 2013 at 21:56
  • 2
    Martin Fowler has a nice discussion of roles and how to model them in the roles pdf on his site. Jul 2, 2013 at 6:46
  • Very nice this article!
    – NaN
    Jul 4, 2013 at 18:36

1 Answer 1


As you said there are many kinds of users that you need to support. There are different types of systems that implement this feature, for example you ask for a database model, but there are also systems based on files, LDAP, web services.

The best you can do is to abstract properly the needs of your application regarding the user permissions and then adapt the implementations to support the needed frameworks.

I would start with something as simple as

public interface UserPermissionsManager{
     void addUser(String userId);
     List<String> listUsers();

Your first implementation could use a file or a database. If you discover that another database schema is better you can migrate it without affecting your code. Your code will not change even if you migrate to LDAP (except the UserPermissionsManager).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.