0

I'm structuring a RBAC in a Web system. My database tables looks like:

  • actions

    • id
    • name
  • resources

    • id
    • name
  • permissions

    • id
    • action_id
    • resource_id
  • roles

    • id
    • name
  • permission_role

    • permission_id
    • role_id
  • users

    • id
    • role_id
    • is_super_admin

The roles are dynamics (users can CRUD them) so if I seed "super admin" role it could be deleted in future. In this way, the first solution that I found was to create a boolean column "is_super_admin" directly in users table and seed the first user (me) with it as true.

What would be possibly the advantages and disadvantages of setting the super admin (the user that can do anything) in users table?

  • Make sure you're providing adequate controls on your roles and permissions. Only certain people should be able to add or remove roles. Nobody should be able to remove the super-admin role, including another super-admin. – Robert Harvey Jul 17 '18 at 13:30
  • @RobertHarvey so you would advises to have a role "super admin" and give it the correct protection for update/delete? – Alexandre Thebaldi Jul 17 '18 at 13:46
  • I suggest you separate the permissions from application database, in an ideal world use an LDAP service. If that is not possible prevent USERS from making changes to this table and ensure it is maintained in a completely separate way, for example via the SQL console only. – Martin Spamer Jul 17 '18 at 15:05
  • I would advise correct protection for update/delete on all of your roles, including super admin. – Robert Harvey Jul 17 '18 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.