My idea is, to create an abstract class / interface which can be extended into a user, and into a usergroup.

There actually is a good reason for there being this interface connecting the groups with the users as the only differences between a user and a group is that you can login as a user and you can't as a group, and that a group can contain multiple users or groups. Permissions and stuff are handled without taking notice of it being a user or a group.

  • What language? The best answer is different in Python, Java and C++.
    – btilly
    Aug 11 '13 at 18:10
  • C++ - How is language relevant though?
    – Jeroen
    Aug 11 '13 at 18:16
  • If I wanted two different kinds of objects to be callable from the same function, in C++ I'd usually create an abstract class, in Java I'd create an interface, and in Python just make sure that the correct methods exist in both classes.
    – btilly
    Aug 11 '13 at 18:27
  • Yeah I have the abstract class made, but what should I name it? :S
    – Jeroen
    Aug 11 '13 at 18:45
  • PermissionEntity would work for me for the abstract concept. But as they say, there are only two hard problems in computer science: naming, cache invalidation and off by one errors.
    – btilly
    Aug 11 '13 at 19:14

In computer security, users and groups are referred to as Principals.

Security principals include the following:

  • Any entity that can be authenticated by the system, such as a user account, a computer account, or a thread or process that runs in the
    security context of a user or computer account.
  • Security groups of these accounts.
  • 1
    You need to put [square brackets] around the item to be linked as well as a bracketed number [n]: link in order for the link to integrate. I've also taken the liberty of placing an excerpt in your post.
    – user28988
    Aug 11 '13 at 19:49

Probably the cleanest answer is to use composition.

Have a class for the group. Have a method on a user that gives the one element group that is the user. Allow one group to be included in another one. Inclusion is a transitive relation, implemented through recursion, that you can speed up at run-time by caching the fact that group X is or is not included in group Y. Add the user to a group by including the user's group in the other group.

And now you never need to have a method that can accept either a user or a group. Any given method either accepts a user and does things that a group cannot do, or accepts the group that you can get from the user.


"EndUser" may be? I thought it can be a name for a group of people related to both the group or single user, they all "use in the end"

Not the answer you're looking for? Browse other questions tagged or ask your own question.