0

I have role based access control to my applications. I have team leader application where team leader with valid role can view their teams performance metrics. Now my top management wants to get a view of the team leader aka they want to mimic a particular team leader to see what they can see.

I am planning to add a table, which captures the

management user id to mimicking team leader user id,

so when i am validating the user, i can check this table and bring the correct view.

Is this a good approach ? Suggestions please

1 Answer 1

1

I have role based access control to my applications.

In this case, management user is just another role, exactly as team leader or ordinary user.

You therefore should extend your access control to the new role without tricks and mimics. If the current way is not able to cope with composite roles, this is definitively something you should implement, but into the basic blocs of your access control.

But if you now start to add a special mimicking table that does access control for management user very differently from anything else, and if you start to switch views when you didn’t use this mechanism before, then it’s no longer “role based” but “ad-hoc growing wild”.

So yes: unless you omitted some key facts that could justify its rationale, the envisaged approach does unfortunately not seem to be a reliable, maintainable, future-proof approach.

16
  • The metrics are on the leader, it wont show up under the management user, thats why want to mimic management user as the leader so they can see the same view?
    – tamilgirl
    Commented Jul 26, 2020 at 16:37
  • The manager user already has the admin role defined, but their view is going to be different from the leader view, leader view shows the statistics which is collected only under the leader
    – tamilgirl
    Commented Jul 26, 2020 at 16:39
  • 1
    @tamilgirl Sound separation of concerns suggest to separate the definition of the metric reporting from the access control issue. So reporting should be based on reporting objectives and data available. If you have a leader with two different teams (e.g his normal team and temporarily the team of a colleague who resigned) team metrics should still be defined by team, even if by coincidence it’s the same leader. If you solve this at team leader level, you solve this at management level, since the manager just has to pic a team of interest.
    – Christophe
    Commented Jul 26, 2020 at 17:14
  • 1
    @tamilgirl Switching views for testing purpose is one thing. But allowing such a switch for real use suggests that views (something that should be structural) are dependent on data that evolves (team leaders). This means to update db structure every time a new team leader is added? This seems not a good idea. Furthermore, over-reliance on views for access control is a frequent source of security issues.
    – Christophe
    Commented Jul 26, 2020 at 17:25
  • 1
    Don't mimic the leader. Commented Jul 26, 2020 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.