0

I have searched around and I can't find any particular answer that addresses what I am asking but no doubt it will have been mentioned already somewhere.

I know that when you inherit from an abstract System.Web.Security.RoleProvider you override this method public abstract string[] GetRolesForUser(string username);

and as the name of the method (GetRoles) and it's return value (string[]) implies, more than 1 role can be returned for a single user, but it could also be restricted to a single item array through a custom role provider.

In my situation I am implementing this in a .NET MVC web app and using a custom .NET role provider, and I have a decision to make as to whether I should allow a user to be in more than 1 role at a time.

I am looking for any general reasons for/against doing this (most specifically implementation reasons).

Most of the points I can think are app domain specific, here are a couple...

  • Deciding which role permissions take priority i.e. what to do when 1 role authorizes a particular action and another is supposed to deny it but both roles are assigned to the same user.
  • Whether to allow users to switch in and out of their roles or to only ever assign 1 role to them and have an administrator change this.

but is there any particularly bad reason why you should avoid giving a user multiple roles at a time? Is it better to give a user only 1 role?

1 Answer 1

3

Roles are one of those things that is strongly domain-dependent. In other words, you assign someone to a Role because that's the role they play IRL.

If you don't allow roles to overlap, you can find yourself in the uncomfortable position of creating "hybrid" roles that encompass multiple responsibilities, for example creating a role that solely describes the "QA Supervisor/Code Administrator/Floor Sweeper" guy.

If you allow multiple roles, you can just assign those three roles, and you're done.

Resolving role conflicts is easy enough; you just decide which one takes precedence, or you assume "deny" unless a specific permission is granted. Users don't normally assign roles to themselves; someone higher up in the food chain has to do that.

5
  • Thanks. What I meant by role switching was that if a user is assigned to 3 roles out of 10 roles.. then you might give them the ability to switch between those 3 at will, its not however something I would feel comfortable with unless the switching was performed in a controlled area of the app, otherwise it could cause issues with steps in a process.
    – Pricey
    Jan 14, 2014 at 22:12
  • Roles define what someone has access to, not what they are doing at any given moment. Jan 14, 2014 at 22:13
  • Is there generally no real issue regarding implementation with MVC and the windows authorization related features when it comes to supporting multiple roles then? your answer gives me the impression that there isnt
    – Pricey
    Jan 14, 2014 at 22:13
  • What real issue might you be referring to? The only real issue that I can think of is that it can be difficult to know exactly what resources someone really has access to, given the roles they are assigned to. Most systems with role-based security solve this by providing a page that lists all of the resources that a particular person has access to, based on the roles they are assigned. Jan 14, 2014 at 22:16
  • I haven't implemented it before in MVC so I couldn't tell you, I was just probing for any tips. Your answer is fine and I can choose later whether to allow multiple roles based on when I get more requirements about the roles i.e. if I end up with roles like "Manager", "Manager with some admin access", "Manager with slightly more admin access", "Manager with full admin access", then its probably better to apply multiple roles to the user i.e. "Manager" + "basic administrator"
    – Pricey
    Jan 14, 2014 at 22:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.