There are different kinds of ACLs I've generally implemented:

  1. Does a user have access to a resourcetype(API)?
  2. Does a user have access to a resource(Object)?
  3. Does a resource have access to another resource?
  4. Is a resourcetype supported for a resource?
  5. Restrict outcome of one metaresoucetype(Seach) based on restrictions on resourcetype.

Except for 1, everything has generally been modeled at the application layer, while (1) is answered by traditional authn/authz mechanisms. This grows immensely complex as the types of resources and resources themselves increase. Since these questions are quite similar, is there a good way to model a general purpose solution to the above class of problems? If so, what are some well known implementations/architectures?

  • There are many such models already in existence. Every operating system has one, for example. ASP.NET MVC has an RBAC that is extensible. What did you have in mind? The one ring to rule them all? – Robert Harvey Jan 11 '20 at 2:36
  • Precisely that. RBAC is still from the PoV of user and resources, not resources and resources. – Amit Ambasta Jan 11 '20 at 7:55
  • What does it mean for a resource to have rights to another resource? Resources by definition are inactive blobs. All it can possibly mean is that if User A has access to resource B, they also have access of some kind to resource C. That can be achieved by simply giving User A access to resource C. Generally these dependencies are managed through a Group. The group having both resource permissions and Users. If you need an automated system to have rights to resources, you would generally solve that by provisioning that system with a user account with the appropriate permissions. – Kain0_0 Jan 12 '20 at 22:50
  • Better example, in transportation, a vehicle can be associated w/ pickup and drop request created at one location to another, if the vehicle is allowed to be associated w/ both locations. – Amit Ambasta Jan 14 '20 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.