What are the different ways for performing authorization in a web application other than role-based authorization?

Question

The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access rights against them. Then assign the users the roles.

Though I find the role based method quite flexible and easy to maintain I am still interested to know whether there are any better methods for storing authorization details.

I am using Spring Security for securing JSF web applications. Along with solutions for Spring Security I would also appreciate general solutions (not specific to a particular security framework).

Answer 1

There's Context-based access control.

In contrast to plain RBAC, CBAC also looks at the situation's context.

An example of a website which uses that is safaribooksonline.com, which students usually can access without identification from within their university's network but not from home, even though in both scenarios they are in the role of an "unidentified visitor".

Answer 2

Roles are probably the most common. Make sure you don't use security roles for other purposes in your application. For example if you want a list of managers and you happen to have a manager security role, don't use it. You may eventually split this group up for security purposes, but still need all of them to be identified as a manager in the application.