Role based security is a very common model for software nowadays. It is very powerful but requires careful configuration to leverage the benefits of shared roles. It is easy for a mess to be made for example when the admin user simply creates a role every time a change is needed (instead of leveraging existing roles).

Very broad question here but as the designer of the role based security software application, how can I assist the user in avoiding this problem? How can I detect duplication or detect ways the security role setup can be normalized?

Edit: I would like to emphasize that customizable security roles is a vital feature in the product. Also, the problem at hand here is to normalize existing configurations that have gotten out of control for existing customers. Discussion on design of the software itself is not what I am after.

  • 3
    Put in some sort of dupe detector that analyzes new roles and identifies whether or not they duplicate (or nearly duplicate) an already-existing role. Then, offer that role in lieu of the new one. – Robert Harvey Aug 31 '17 at 20:56
  • @RobertHarvey Right it is obvious that detecting duplicates is a 100% certain way of detecting a problem. Other than that I guess it would be a matter of defining what nearly duplicate means and decide on the metric that would be helpful but not intrusive – James Aug 31 '17 at 21:00

The best way is to not let the users make new roles

If you can't do that then put barriers in the way of new role creation. They have to fill in a form, with a business case which has to be approved by several people and signed off by legal against your data protection policy or something.

If you can't do that then good reporting and display of what users are in what role. Good descriptions of each role so that new users can be easily put into the same one their colleges are in.

As to "programmatic normalising" I don't think its going to be a runner. The very nature of comparing the roles implies a table of allowed actions and tick boxes which is exactly the thing that roles are supposed to stop.

Show the users two roles which only differ by one permission and they will immediately want to create a new role with a subset of the permissions they see on the screen. Not get rid of one of the roles.

Users will always have reasons to want new roles even if they are 100% identical. "If they are in the same row then they all show up the same colour on the holiday calendar", "I need to new name so that my special spreadsheet report that I do for cake club wednesdays looks nice!" etc etc

  • I neglected to mention the customization of security roles is one of the most important features of the product and must be configurable (the software is a flexible CRM SaaS product). Good info – James Aug 31 '17 at 23:14
  • +1 for the overall approach. However, there can be reasons to have two or more roles with the same current permissions, since one might change at some point while the other doesn't. Bottom line, most admins should only have access to assigning well-known roles to users, whereas only some should be able to define new roles. Try to use the roles to reach the notion of business relevant roles rather than merely IT relevant access permissions. – Erik Eidt Aug 31 '17 at 23:44

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.