Questions tagged [access-control]
The access-control tag has no usage guidance.
72
questions
0
votes
1
answer
60
views
Role Based Access Control: Inline vs Centralized
I have a server with many methods that can be requested by a user (or other service). I want to implement a role based access control. I can think of 2 ways to do it.
Inline: Each method has ...
- 143
-1
votes
2
answers
136
views
Efficient access control list for collections of objects returned by REST api
We have a REST api endpoints that return collections of objects where users could perform different types of actions on those objects. We need it to turn on/off different UI options based on that ...
- 113
0
votes
0
answers
20
views
Use of extra claims in a token for authorization checking purposes
Currently we are moving to an API driven architecture using SPAs and WebAPIs. We are also moving from SAML2 to OAuth 2.0 and if it is appropriate, OIDC.
We have a couple of APIs and one of the APIs ...
2
votes
3
answers
2k
views
Clean Architecture and Access Control
I'm working on a .Net core API for product configuration and ordering. The ticket for Permissions has come up and I've been tasked with developing a solution, ideas of middleware have been mentioned.
...
- 123
-2
votes
1
answer
399
views
Storing a large number of user permissions [closed]
I am refactoring an old application which has about 200 user permissions.
Based on access permissions for the user, menu items for webpages will be Enabled or not.
Permissions are also checked on the ...
- 97
0
votes
1
answer
122
views
Should I create access control as a microservice or keep the access control logic as part of the specific microservice?
I was wondering if I have a microservice called, for example, Weather, and only certain people can update certain properties around the weather such as Temperature, Precipitation, and Wind.
These ...
0
votes
2
answers
184
views
Implement authorization logic also in frontend or send authorization info along with the resource?
We have an ongoing argument in our team. Please help. Here is the problem:
In our SPA web app, let's say we have a resource which can be edited by only those users who belong to the team of the user ...
- 101
1
vote
0
answers
34
views
Optimised MongoDB design for access control at project/organisation level
I'm looking for the optimised approach of designing MongoDB database collections where there are three stakeholders-
A User (who accesses a portal).
An Organization (which can have multiple Projects)....
- 111
3
votes
1
answer
2k
views
What's the difference between policy vs permission based access control?
I am newbie at these stuff and while I was able to distinguish between role-based vs. policy-based authorization models, I can't seem to understand whether there is one between policy-based vs. ...
- 141
1
vote
2
answers
153
views
RBAC and domain specific roles
I have some doubts about RBAC which I cannot wrap my head around. So I would like to hear what you guys think.
Though I understand the concept of RBAC, I cannot figure out how to apply that to my ...
- 13
2
votes
1
answer
540
views
Should a Web Application File URL Have Public or Private Access
I am debating whether to give my files a public url or a limited private one.
I am hosting various files for a mobile/web application. These will include product images and videos. Currently only ...
- 181
0
votes
1
answer
190
views
OWASP Broken Access Control by example: preventing user's from reading/writing data that isn't theirs
I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them.
A situation was just presented to me that ...
0
votes
1
answer
64
views
Mimic a leadership metrics for management users
I have role based access control to my applications. I have team leader application where team leader with valid role can view their teams performance metrics. Now my top management wants to get a ...
- 19
-3
votes
2
answers
150
views
Dependency access control in DI
As I'm just getting into ASP.NET Core, I'm also continuing to slowly learn about Dependency Injection and still trying to identify some value in it for our practical purposes. The point I've reached ...
- 189
9
votes
4
answers
3k
views
Should access control be implemented in controller or repository layer?
I've got a project with an HTTP API which returns data from a database. The layers it goes through to get to the API look like this:
DB -> Repository -> Controller
I'm looking to restrict the ...
- 149
2
votes
1
answer
2k
views
License control for an on-premise application
TL;DR How do you build an airtight license control system for your onprem application, which revokes access once subscription ends?
Premise
I am building this application in Python that needs to ...
- 129
1
vote
0
answers
81
views
How to model ACLs?
There are different kinds of ACLs I've generally implemented:
Does a user have access to a resourcetype(API)?
Does a user have access to a resource(Object)?
Does a resource have access to another ...
- 19
2
votes
2
answers
79
views
Customized access control using OAuth 2.0
I'm designing a enterprise infrastructure monitoring application which has customized needs of access control, beyond roles and authorities.
The architecture include multiple nodes of REST API being ...
- 55
-1
votes
1
answer
446
views
Updating last resource access time when clients perform a GET
We have many clients which, upon start up, request a specific resource on the server using an HTTP API (not RESTful). This resource is - currently, identical for all clients.
Naturally, since the ...
- 101
0
votes
0
answers
78
views
Is tagging an acceptable way to circumstantially add or remove user permissions in a role-based system?
Background
Our users can have a single role per account (internally an IAM domain), but may have roles across multiple accounts.
Each role is defined as a list of permissible actions.
Problem
In ...
- 471
2
votes
2
answers
3k
views
How to efficiently pass permissions that control view and access of specific front-end elements from backend to the SPA using JWT
I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT).
Permission Requirement:
...
- 171
2
votes
2
answers
5k
views
What can I use as an alternative to protected interface methods in Java?
Occasionally, I want to write an interface that provides some complex method, and I want to make that a default method that uses some protected helper methods.
The objective is such that I can later ...
user338229
3
votes
2
answers
440
views
Where to put domain knowledge for Authorization?
I hope this is the correct SE site for this kind of question.
My team is currently developing an application which IMO needs access control beyond RBAC. Users can have access rights to entities based ...
1
vote
8
answers
913
views
Is there a way to prevent developers leaking data while they are developing?
I am working with a startup company for a while now. They have been affected by some reckless developers in the past. One area they want a real and immediate improvement is when they assign a task to ...
- 127
-1
votes
3
answers
422
views
restricting access to a public setter
My question is how I can achieve more encapsulation in TypeScript.
I have a class Item, with a public setter isOwned, but I only want to call this method in specific situations: if the item is picked ...
- 264
0
votes
1
answer
292
views
One person controls only one folder, in a repository
How can I give complete control of one folder to one person, while the rest is in the control of another person. Control means they have the power to approve pull requests and commit to master and ...
- 101
27
votes
6
answers
7k
views
Is it ok to have validation layer before access control layer
I am creating an API strcutured web application and in this application we have different layers which are doing their own job.
First layer is Validation layer which validate user input and if it ...
- 399
8
votes
2
answers
3k
views
Is XACML actually used and implemented?
I have been working for quite a lot of time on a research project at University focused on Access Control. More specifically, I am studying how to protect unauthorized access to personal data in a ...
- 141
2
votes
1
answer
709
views
Thinking about roles and permissions
I am creating a brand new Housing application which lets user rate or favourite the houses. The following are users of the application:
Owner
Agent
Guest (not logged in)
Visitor (logged in)
Tenant
...
- 2,176
4
votes
1
answer
1k
views
Designing a role based system with more granularity
I am designing a resource request system where an user can request resource of different types. There can be many resource types such as:
VM
DB
File System
etc
Above types can have sub-types and i.e....
- 2,176
4
votes
2
answers
115
views
Performance considerations with access control in a distributed system architecture
We're currently working on upgrading a small information system for an enterprise. Currently, the system has a corporate network zone (CORP) where services for internal users are placed, and a data ...
- 191
1
vote
1
answer
139
views
Implementing Permissions Control for Related Data Resources
Imagine a data model of an electric company and the city it powers. The company has several departments that manage at least one neighborhood each in the city. The company database includes ...
- 105
20
votes
1
answer
6k
views
What is a suggested roadmap towards implementation of a simple Attribute-based access control (ABAC)?
When reading about ACL and RBAC I seem to understand it easily - there are either usernames or roles that are given access to an asset. I can also see how I could implementing those.
i.e. this image ...
- 8,247
5
votes
2
answers
793
views
Authorization checks without littering them in code
My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
- 153
-1
votes
2
answers
187
views
Should I prepopulate resources and permissions in my system?
I am following the rbac model in my system.
I want to know if I should prepopulate the resources and permissions table?
I have resources like contracts, contract_drafts, SLA (service level agreement)...
- 489
-1
votes
1
answer
140
views
How to make sure I have the contract proposal approval in my system?
I am building a website and in it I am trying to follow the rbac (role-based access control) model.
Now, the thing is that managers need to send their contract proposals to approvers
(people who will ...
- 489
31
votes
2
answers
47k
views
How to design role based access control?
I am trying to follow the role bases access control model to restrict what users can or cannot do in my system.
So far I have the following entities:
users - People who will use the system. Here I ...
- 489
3
votes
1
answer
2k
views
Extending ACL with more sophisticated rules in web REST API
I am currently working a REST API design and I am looking for a way to add an advanced ACL management, beyond what
Let's consider for instance that I have a route which is the following :
/profile/...
- 241
1
vote
2
answers
320
views
Should an internal Software Documentation Wiki have private pages?
I'm working on the creation of a software and product documentation in a wiki format. It will include the documentation for all the company products.
After some research, we decided to use the ...
- 171
1
vote
1
answer
86
views
Control access to objects properties
I'm a front-end web developer and currently facing a situation where I have one form with few parameters of one object and to save them I should make few requests to few different API endpoints. As I'...
- 119
0
votes
2
answers
89
views
Implementing a publicly-editable tree where each node must hold private implementation data
I am trying to implement a tree data structure that callers of my code edit for me to operate on. The idea is that the caller can hold a reference to nodes from the tree and modify their data (both ...
- 103
1
vote
1
answer
963
views
Adding support for privileges to an ASP.NET MVC application already supporting roles based authorization
I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to ...
- 137
3
votes
1
answer
175
views
How to structure path-colliding REST webservices with role-access
I have a bunch of REST webservices that my client uses. For instance, to create a user, I have
POST /users
and to modify it
POST /users/{id}
The problem is, some fields, as marketArea, are allowed ...
- 1,647
2
votes
1
answer
284
views
What kind of security enforces a tree of permissions on it's users?
I'm looking for a name or design pattern on an ACL Based permission system (at least, I think it has some features of ACL).
The case
An admin is allowed to create Managers. These managers will be ...
- 31
2
votes
1
answer
810
views
Centralize permission evaluation
I am looking for a viable design/architecture pattern for securing several web applications. Here is the situation:
Multiple web applications must enforce roles and permissions at Java service method ...
- 668
71
votes
3
answers
36k
views
Role vs Permission Based Access Control
I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization).
Let's start with a given: in our system, a Permission will be a fine-...
- 4,910
1
vote
1
answer
219
views
REST API and user rights
I am developing an application using Angular and REST API and I'm facing a problem concerning user access right.
The application runs this way:
A user signup
The same user creates his organization
...
- 395
1
vote
2
answers
161
views
Should "special" roles exist in an ARO system?
Right now we're implementing a (honestly overly complex) role-based permissions system where users will be assigned to roles and those roles will be granted permissions on some combination of ...
- 473
1
vote
2
answers
1k
views
PHP MVC how to access current user?
What is the best way to tell if a user is already logged in when accessing the page? I have seen many people talk about a Recognition service that will validate a user trying to login, but what about ...
- 211
32
votes
6
answers
6k
views
Dynamic Code Evaluation in Java - Clever or Sloppy?
I am trying to create a flexible ACL framework in Java for my application.
Many ACL frameworks are built on a whitelist of rules, where a rule is in the form of owner:action:resource. For example,
"...
- 423