-1

I am following the rbac model in my system. I want to know if I should prepopulate the resources and permissions table?

I have resources like contracts, contract_drafts, SLA (service level agreement), etc. And permissions like create contract, modify contract, approve contract, etc.

Now, I want to know if the system should already have the main resources and permissions loaded into it when I give it to the users?

Because what if I need to know the permissions a certain role has over a contract resource but that contract resource hasn't even been created by the admin yet?

How can I even make sure that there will be contract resource in the system?

Or should the only things that can be in the admin's control are roles and users? Which means that permissions and resources will be predefined. He just has to assign them to the correct roles and users.

Another thing that can happen by allowing the resources to be created by the admin is that he might even create a resource called electronics for example which has nothing to do with my system.

Please feel free to ask for any clarification.

| improve this question | |
  • 1
    I think this's something to look at the SLA contracted by the customer. Ask to the project manager first. If users have no way to populate the data then you will have to. Probably you will have to ask to the customer which roles do they need, which resources, etc and automate the load. – Laiv May 11 '17 at 21:48
  • Did somebody ask you to do this work? – Stop harming Monica Jun 12 '17 at 21:59
0

This is linked to your other question on RBAC and database design. No you should not have to prepopulate permissions. Besides, if the record (contract) does not exist, how can you possibly already populate permissions.

This is where ABAC (attribute-based access control) comes in handy. In ABAC you do not need to prepopulate (provision) permissions. Authorization is checked at runtime based on the user identity (Alice), the intended action (view), and the resource identity (contract #123).

If you stick to RBAC, you will have to think about the lifecycle of your objects. When is a contract created? Who owns it? Should you then pre-populate permissions (upon creation)?

| improve this answer | |
  • Let me clear something first. You see, in my database I have tables and one of them is called contracts. Am I correct in saying that contract is a resource? I assume it is because it is one of the things that users (or managers to be precise) will be manipulating. So are contracts resources? – imran.razak May 11 '17 at 21:39
0

 I want to know if I should prepopulate the resources and permissions table?

...

Now, I want to know if the system should already have the main resources and permissions loaded into it when I give it to the users?

The answer, as usual is depends.

It may depends on :

SLA

Your customer may have included a initial data load in the SLA. Let's suppose the data can be introduced manually but, due to the size, it would take too much efforts and time. Think in the lonely Admin loading hundred or thousand users, resources, etc in the system manually.

System constraints

Same scenario, a large set of data but, this time, there's​ no public interface (no API, no web page, no app,...)

Legacy data transfer

Well, just that. Think in customers that have been storing the info in documents such as: excels, xml, csv, pdf, ...

If you are unsure about the preload, ask to the project manager first. Even if the initial load has not been settled, the customer could be interested.

If that's the case, It's usually this last who provides you the data or its source.

| improve this answer | |
  • Maybe I am being able to make it clear. The problem is not about contracts, SLAs or other data. The problem is about which permissions and resources are available in my system. I have tables called contracts, SLAs and other stuff. But I also have a table called resources. Inside resources, there will be all the names of the things that users can manipulate. – imran.razak May 13 '17 at 8:42
  • I have referenced the questions I'm trying to answer. Let me know If I didn't understand the questions. – Laiv May 13 '17 at 10:42
  • I have a table called resources. It has only one column, called name. It is unique. The data that will be inserted in the resources table is basically the names of other tables that I have in my database, like contracts, SLA. It will look like this: row 1 - name: contract; row 2 - name: SLA; row 3 - name: users; etc. So the thing is that the admin will be able to say: user X has permission to view resource Y, where resource could be contract, so it becomes, user X has permission to view resource contract. So I wanted to know if I should predefine these resources ? – imran.razak May 13 '17 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.