Questions tagged [access-control]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
5
votes
4answers
311 views

Should access control be implemented in controller or repository layer?

I've got a project with an HTTP API which returns data from a database. The layers it goes through to get to the API look like this: DB -> Repository -> Controller I'm looking to restrict the ...
-2
votes
0answers
14 views

Beginner Directory Service Set-up for Membership and Asset Management [closed]

I am an administrator in a non-profit membership based organization with about 60 members. I would like lay down a fresh software foundation for membership management and user access control to our ...
1
vote
1answer
145 views

License control for an on-premise application

TL;DR How do you build an airtight license control system for your onprem application, which revokes access once subscription ends? Premise I am building this application in Python that needs to ...
1
vote
0answers
59 views

How to model ACLs?

There are different kinds of ACLs I've generally implemented: Does a user have access to a resourcetype(API)? Does a user have access to a resource(Object)? Does a resource have access to another ...
0
votes
0answers
42 views

AEM Access Control List (ACL) evaluation

Suppose a user of Adobe AEM is part of 2 groups in the access control list, one with "allow" permission and the other with "deny". Which permission will get applied: "Allow" because it has higher ...
1
vote
2answers
60 views

Customized access control using OAuth 2.0

I'm designing a enterprise infrastructure monitoring application which has customized needs of access control, beyond roles and authorities. The architecture include multiple nodes of REST API being ...
0
votes
1answer
59 views

Updating last resource access time when clients perform a GET

We have many clients which, upon start up, request a specific resource on the server using an HTTP API (not RESTful). This resource is - currently, identical for all clients. Naturally, since the ...
2
votes
2answers
699 views

Permission Based Access Control with JWT

I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT). Permission Requirement: ...
0
votes
2answers
996 views

What can I use as an alternative to protected interface methods in Java?

Occasionally, I want to write an interface that provides some complex method, and I want to make that a default method that uses some protected helper methods. The objective is such that I can later ...
3
votes
2answers
181 views

Where to put domain knowledge for Authorization?

I hope this is the correct SE site for this kind of question. My team is currently developing an application which IMO needs access control beyond RBAC. Users can have access rights to entities based ...
1
vote
8answers
692 views

Is there a way to prevent developers leaking data while they are developing?

I am working with a startup company for a while now. They have been affected by some reckless developers in the past. One area they want a real and immediate improvement is when they assign a task to ...
0
votes
1answer
178 views

restricting access to a public setter

My question is how I can achieve more encapsulation in TypeScript. I have a class Item, with a public setter isOwned, but I only want to call this method in specific situations: if the item is picked ...
0
votes
1answer
167 views

One person controls only one folder, in a repository

How can I give complete control of one folder to one person, while the rest is in the control of another person. Control means they have the power to approve pull requests and commit to master and ...
25
votes
6answers
4k views

Is it ok to have validation layer before access control layer

I am creating an API strcutured web application and in this application we have different layers which are doing their own job. First layer is Validation layer which validate user input and if it ...
7
votes
2answers
1k views

Is XACML actually used and implemented?

I have been working for quite a lot of time on a research project at University focused on Access Control. More specifically, I am studying how to protect unauthorized access to personal data in a ...
2
votes
1answer
444 views

Thinking about roles and permissions

I am creating a brand new Housing application which lets user rate or favourite the houses. The following are users of the application: Owner Agent Guest (not logged in) Visitor (logged in) Tenant ...
3
votes
1answer
712 views

Designing a role based system with more granularity

I am designing a resource request system where an user can request resource of different types. There can be many resource types such as: VM DB File System etc Above types can have sub-types and i.e....
4
votes
2answers
74 views

Performance considerations with access control in a distributed system architecture

We're currently working on upgrading a small information system for an enterprise. Currently, the system has a corporate network zone (CORP) where services for internal users are placed, and a data ...
1
vote
1answer
99 views

Implementing Permissions Control for Related Data Resources

Imagine a data model of an electric company and the city it powers. The company has several departments that manage at least one neighborhood each in the city. The company database includes ...
12
votes
1answer
3k views

What is a suggested roadmap towards implementation of a simple Attribute-based access control (ABAC)?

When reading about ACL and RBAC I seem to understand it easily - there are either usernames or roles that are given access to an asset. I can also see how I could implementing those. i.e. this image ...
5
votes
2answers
545 views

Authorization checks without littering them in code

My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
-1
votes
2answers
158 views

Should I prepopulate resources and permissions in my system?

I am following the rbac model in my system. I want to know if I should prepopulate the resources and permissions table? I have resources like contracts, contract_drafts, SLA (service level agreement)...
-1
votes
1answer
115 views

How to make sure I have the contract proposal approval in my system?

I am building a website and in it I am trying to follow the rbac (role-based access control) model. Now, the thing is that managers need to send their contract proposals to approvers (people who will ...
16
votes
2answers
28k views

How to design role based access control?

I am trying to follow the role bases access control model to restrict what users can or cannot do in my system. So far I have the following entities: users - People who will use the system. Here I ...
3
votes
1answer
1k views

Extending ACL with more sophisticated rules in web REST API

I am currently working a REST API design and I am looking for a way to add an advanced ACL management, beyond what Let's consider for instance that I have a route which is the following : /profile/...
0
votes
2answers
238 views

Should an internal Software Documentation Wiki have private pages?

I'm working on the creation of a software and product documentation in a wiki format. It will include the documentation for all the company products. After some research, we decided to use the ...
1
vote
1answer
59 views

Control access to objects properties

I'm a front-end web developer and currently facing a situation where I have one form with few parameters of one object and to save them I should make few requests to few different API endpoints. As I'...
0
votes
2answers
76 views

Implementing a publicly-editable tree where each node must hold private implementation data

I am trying to implement a tree data structure that callers of my code edit for me to operate on. The idea is that the caller can hold a reference to nodes from the tree and modify their data (both ...
1
vote
1answer
903 views

Adding support for privileges to an ASP.NET MVC application already supporting roles based authorization

I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to ...
3
votes
1answer
65 views

How to structure path-colliding REST webservices with role-access

I have a bunch of REST webservices that my client uses. For instance, to create a user, I have POST /users and to modify it POST /users/{id} The problem is, some fields, as marketArea, are allowed ...
2
votes
1answer
152 views

What kind of security enforces a tree of permissions on it's users?

I'm looking for a name or design pattern on an ACL Based permission system (at least, I think it has some features of ACL). The case An admin is allowed to create Managers. These managers will be ...
2
votes
1answer
638 views

Centralize permission evaluation

I am looking for a viable design/architecture pattern for securing several web applications. Here is the situation: Multiple web applications must enforce roles and permissions at Java service method ...
47
votes
2answers
25k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
1
vote
1answer
178 views

REST API and user rights

I am developing an application using Angular and REST API and I'm facing a problem concerning user access right. The application runs this way: A user signup The same user creates his organization ...
0
votes
2answers
132 views

Should “special” roles exist in an ARO system?

Right now we're implementing a (honestly overly complex) role-based permissions system where users will be assigned to roles and those roles will be granted permissions on some combination of ...
1
vote
2answers
881 views

PHP MVC how to access current user?

What is the best way to tell if a user is already logged in when accessing the page? I have seen many people talk about a Recognition service that will validate a user trying to login, but what about ...
31
votes
6answers
6k views

Dynamic Code Evaluation in Java - Clever or Sloppy?

I am trying to create a flexible ACL framework in Java for my application. Many ACL frameworks are built on a whitelist of rules, where a rule is in the form of owner:action:resource. For example, "...
11
votes
4answers
494 views

When should a private method take the public route to access private data?

When should a private method take the public route to access private data? For example, if I had this immutable 'multiplier' class (a bit contrived, I know): class Multiplier { public: Multiplier(...
-1
votes
1answer
368 views

mongoDB user management (built in or own implementation) [closed]

I started to evaluate mongoDB for a product catalogue. Regarding user management and access control: When to use the mongoDB's built in user management and when build one on the application layer? ...
1
vote
1answer
452 views

How can I simplify the following Access Control system design?

I couldn't find a better title for this... I am trying to create an Access Control for my application and I am having serious trouble with building not an insane system, mainly for performance as ...
2
votes
1answer
107 views

Privilege (Access/Permission) Control for Hierarchial Structured Resource

Question: Is there any standard model or industry defacto implementation for modeling and implementing Access Control in (i.e.) a Document Management System? Note: I studied a bit the security ...
2
votes
1answer
410 views

Embedding XACML PDP?

I need to implement a flexible Access Control system for a framework used by a couple of .NET applications. I have looked into Attribute-Based Access Control (ABAC) and XACML and this seems to ...
6
votes
3answers
11k views

Is it a good idea to const-qualify the fields of structure in C?

Consider the following program: #include <stdlib.h> #include <stdio.h> typedef struct S_s { const int _a; } S_t; S_t * create_S(void) { return calloc(sizeof(S_t), 1); } void ...
3
votes
3answers
211 views

How do I recreate this Access Control/Group/ whatever methodology in OO/MVC

I am looking at trying to rewrite an application that is mostly procedural to an MVC/OO approach in order to teach myself a deeper understanding of both. BUT, I am having some conceptual issues with ...
9
votes
2answers
3k views

Standard practices for access control (design pattern)

I'm looking at my interface design and I am struggling to decide which is the most "correct" way to implement role-based access control, given a user and a subject that the user would like to access. ...
0
votes
1answer
170 views

Using a Proxy as an ACL

I am building an MVC application in PHP, using Zend Framework. My model includes Domain Model and Mapper layers. I am trying to keep the domain model in pristine condition and have managed to keep ...
3
votes
1answer
643 views

Restrictive routing best practices for Google App Engine with python?

Say I have a simple structure: app = webapp2.WSGIApplication([ (r'/', 'pages.login'), (r'/profile', 'pages.profile'), (r'/dashboard', 'pages.dash'), ], debug=True) Basically all pages ...
1
vote
0answers
201 views

Using a Finite State Machine for access management?

My intranet site uses LDAP and Active Directory to authenticate users. There are 2 kinds of Users: Managers and Employees. They are differentiated by having membership in a particular AD group. In an ...
6
votes
1answer
3k views

What is the nicest (user-friendliest) way to tell a user about “Access Denied” error?

Our software implements a layer of role-based security to secure data access, in the form of access control lists. Whenever a user tries to do something that isn't allowed, the software layer will ...
0
votes
2answers
3k views

How to implement a hybrid role-based access control model?

I am writing an enterprise web-forms-frontend application for in-house use. It has Direct access control (DAC) masquerading as Role-based access control (RBAC). For anonymization purposes, let's ...