The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access rights against them. Then assign the users the roles.

Though I find the role based method quite flexible and easy to maintain I am still interested to know whether there are any better methods for storing authorization details.

I am using Spring Security for securing JSF web applications. Along with solutions for Spring Security I would also appreciate general solutions (not specific to a particular security framework).

2 Answers 2


There's Context-based access control.

In contrast to plain RBAC, CBAC also looks at the situation's context.

An example of a website which uses that is safaribooksonline.com, which students usually can access without identification from within their university's network but not from home, even though in both scenarios they are in the role of an "unidentified visitor".


Roles are probably the most common. Make sure you don't use security roles for other purposes in your application. For example if you want a list of managers and you happen to have a manager security role, don't use it. You may eventually split this group up for security purposes, but still need all of them to be identified as a manager in the application.

  • 3
    The OP specifically asked for different ways. The hint about reuse should probably be a comment as it's not directly answering the question.
    – blubb
    Commented Aug 4, 2011 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.