1

I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to authorize action methods based on these roles.

Now I want to add support for privileges so that action methods can be restricted based on those as well, rather than just by roles. For example, in a Controller, I may have an HTTPPost action that only someone with a "Write" privilege should be able to perform successfully.

What changes do I need to make so that I can assign privileges to roles? I.E., I want to select the "Admin" role to have the "Write" and "Read" privileges, while a "BasicUser" role will only have a "Read" privilege. This way, an Admin can access any method that is allowed by the Write privilege, while the BasicUser can not.

1

This could be as simple as hanging a few more fields onto the Role table, like CanRead and CanWrite. If you want it to be more sophisticated than that, add a RolePermission table with a Role foreign key.

See Also
Don’t Do Role-Based Authorization Checks; Do Activity-Based Checks.

  • Using this approach, how can I restrict an action based on the privilege? Also I wanted to clarify that the CanRead and CanWrite are just two examples out of many possible privileges there can exist in the system. – ITWorker Jul 26 '16 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.