I'm writing a fairly simple authentication/authorisation api for an intranet application we are developing.

It's my first roles based authorisation system and its a good opportunity for a first timer because it is located on a Windows VPS that is isolated to the internal corporate network with no internet access at all, so any mistakes I make won't have any huge consequences.

That said, I still want to do it right.

So I wanted to know if my method below is on the right track and welcome any suggestions for improvement you guys might have.


  • I'm using the MEAN stack as it fits the business case nicely.
  • I have bolded the points that I am concerned about or not so sure they are the best way of doing things.
  • In case I am using the wrong terminology for some things I have included my definitions below so you know what I'm trying to say.
  • Definitions:
    • Site-level permissions: The specific states/pages a user has access to
    • Domain: in this context is the specific data collections the user has access to.
      • This access is persistent across pages so there's nothing like User has access to Domains X and Y on Page A and Domains W and Z on Page B. If a User has access to Domains X and Y, then this is used for all site-level states.

Here's what I'm thinking:

Account Creation

  1. User account is created
  2. Using Active Directory (AD), we determine site-level permissions and domain-specific permissions
    • Store User Identifier and site-level permissions in DB


  1. The authentication api verifies Identity and returns an JSON web token (JWT)
  2. The identity token is then used to get another token specifically for authorisation. The payload of the JWT contains the role specific site-level and domain-level permissions for that user.
  3. Auth Token is returned to the Client and checked in $routeChangeStart event of ui-router
  4. Angular then sets the appropriate state for the requested view based on the permissions.

Specific Questions for the programmers.stackexchange gurus:

  • Does this look like an ok way to implement an Authorisation system?
  • Given that I have access to Active Directory am I overcomplicating this by storing permissions in a Roles collection in Mongo?
  • Are there any rookie flaws in this design that I should correct/ do more reading on?

Thanks for taking the time to read this and I really appreciate any feedback you might have.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.