Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [permissions]

The tag has no usage guidance.

0
votes
0answers
36 views

Should a new access control mechanism use a precedence-based or an order-based permission system?

Let's say I have users, groups (or "roles") and resources, and I want to manage various permissions on those resources. As far as I can see, there are two main "philosophies" when it comes to ...
0
votes
0answers
37 views

Pros and cons of setting super admin in users table

I'm structuring a RBAC in a Web system. My database tables looks like: actions id name resources id name permissions id action_id resource_id roles id name permission_role permission_id ...
1
vote
1answer
407 views

Dealing with permissions for the list of resource

I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions. Now I need to build a new service. ...
0
votes
0answers
49 views

How to architect permissions in mutliple roles per entity?

The goal is to create a fairly typical CRUD-based permission and role scheme for a multi-user, client-server desktop application. Goal A Permission marks some functionality of the application with ...
0
votes
0answers
294 views

Scalable architecture for multi-tenant auth solution

We're evaluating two different architectures for setting up KeyCloak to allow users to grant access to other users and third parties to tenants within our system. I'm looking for experienced feedback ...
6
votes
2answers
2k views

Implementing DDD: users and permissions

I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
1
vote
1answer
262 views

REST API for different User Roles in a SAAS application

Need some help in the desing of the Auth/Permissions of a REST API for a SAAS app. I'd done a prototype of a SAAS app and for permissions of the SAAS client, I'd setup the API to request for a header ...
3
votes
0answers
83 views

How do large scale permission systems work with membership expansion?

Let's say you have a permission system with which you can specify things like: user U is a member of group A, which is a subgroup of group B, which is a subgroup of group C, and all members of group C ...
3
votes
3answers
432 views

REST Api - Check if Action is allowed for entity

I'm asking this question for a colleague since he doesn't have enough reputation to post images in a question During our normal development we found a deficit in our REST Api. We display entities in ...
1
vote
1answer
67 views

Implementing Permissions Control for Related Data Resources

Imagine a data model of an electric company and the city it powers. The company has several departments that manage at least one neighborhood each in the city. The company database includes ...
1
vote
1answer
34 views

Access security for user profiles

I have a User Authentication module in my project, that is managing all user information and is regulated with certain granular access rights as Create User, Change User and Delete User. These are ...
1
vote
1answer
85 views

Section of program needs root access

I have to perform a number of 'housekeeping' tasks that need root access (Linux, Debian). Generally one time only, but I do need to check that they have been performed. I don't really want to run the ...
8
votes
1answer
932 views

What is a suggested roadmap towards implementation of a simple Attribute-based access control (ABAC)?

When reading about ACL and RBAC I seem to understand it easily - there are either usernames or roles that are given access to an asset. I can also see how I could implementing those. i.e. this image ...
-1
votes
2answers
93 views

Should I prepopulate resources and permissions in my system?

I am following the rbac model in my system. I want to know if I should prepopulate the resources and permissions table? I have resources like contracts, contract_drafts, SLA (service level agreement)...
8
votes
2answers
9k views

How to design role based access control?

I am trying to follow the role bases access control model to restrict what users can or cannot do in my system. So far I have the following entities: users - People who will use the system. Here I ...
2
votes
0answers
450 views

Handling account roles in Android app

I'm building an Android app where different "types" of users can log in - lets say User and Admin are the two roles (there could be more than two). User can access some views in the app, by pressing ...
6
votes
3answers
251 views

How to cleanly implement permission based feature access

I have been tasked with writing an on/off control for features in our product based on who is signed in, in principle with one on/off flag for each feature. Put simply, this is a permission based ...
1
vote
1answer
117 views

Controlling permissions for content on web server (pattern/architecture)

I’m working on a proof of concept for a personal project and am unsure how to go about handling ‘permissions’ on content that is uploaded into the application. Problem: In this application users ...
7
votes
2answers
635 views

Permission system using PHP and JS

I'm developing an admin dashboard with different areas, where different users may have different permissions. For example: News John: edit, view, add, remove; Carlos: edit, view; Mario: --; Support ...
2
votes
3answers
625 views

How to keep database user permissions under source control

I use liquibase for source control of our database. I put there changes to the schema, static data and procedures. So far I've kept permissions out of it; we have just four users with very well ...
1
vote
1answer
51 views

One shared account for running CI infrastructure?

Should I set up a shared account in our CI infrastructure to make it easier to use? My team uses CI infrastructure. When a developer first sets up a build he must enter his source control credentials ...
4
votes
1answer
635 views

Extending ACL with more sophisticated rules in web REST API

I am currently working a REST API design and I am looking for a way to add an advanced ACL management, beyond what Let's consider for instance that I have a route which is the following : /profile/...
2
votes
4answers
1k views

How to keep permissions of users in a database?

What is the accepted way of keeping track of a user's permissions in a database? Say I have a web app where users can pay for privileges. To use a straightforward analogy, imagine Github's users (...
1
vote
1answer
1k views

Managing permissions in hierarchical groups

I'm currently writing a web application for our small company which was originally just planned to organize appointments more efficiently by displaying our customer structure and automatically plan ...
1
vote
1answer
693 views

Adding support for privileges to an ASP.NET MVC application already supporting roles based authorization

I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to ...
8
votes
4answers
2k views

Correct Way to Implementing Authorization Checks in ASP MVC

In ASP MVC we have the Authorize attribute to perform check at either a controller level or at a controller method level. But what if you need to do check permissions inside a controller method e.g ...
2
votes
1answer
264 views

Should I make myself a superadmin?

I am currently developing a web application (in Ruby on Rails) for my university's department. The web application's user base have several roles: director (the director and assistant director of the ...
2
votes
3answers
4k views

How to simplify this Role and Permission management design?

I'm working on a web application that has users with multiple roles and each user can perform multiple operations, based on user's role, and the permission level the role has on the operation. I came ...
0
votes
0answers
65 views

Who should be reliable for permissions check in a web app?

I am working on a project where you have controllers that expose an API and services that implement some logic. In this project, each service* checks for the user's permissions to use the service. ...
2
votes
0answers
109 views

Better dynamic user permissions

I support an Internal ERP system and an external Reporting/Dashboard that our customers use that both use the same database. Internal normal application users can control what customers can access ...
1
vote
2answers
121 views

How to represent complex permissions system in single hash or set of characters?

Eve Online, a game I used to play, had an interesting "permissions" system for account interactions with other apps. The permissions encompassed dozens of individual permissions, each under a ...
5
votes
1answer
199 views

Reasons not to have flexible role management system

Our .NET web application has the ability to add roles dynamically and assign functionalities (we define them in an application enum) to that role. So those functionalities are defined by us (our ...
2
votes
2answers
933 views

Fine-grained data level permissions on a laravel RESTful API

The problem: We want to restrict access to properties returned from our services. Details: We have route level permissions working with no issue. For a user that can view /product/{id} for example,...
2
votes
1answer
99 views

What kind of security enforces a tree of permissions on it's users?

I'm looking for a name or design pattern on an ACL Based permission system (at least, I think it has some features of ACL). The case An admin is allowed to create Managers. These managers will be ...
-2
votes
2answers
114 views

Tables vs. Booleans: Which of the two are more secure for setting admin roles in an app? [closed]

I'm currently in the process of setting up roles where there are regular users, admins, and super admins, each of which have special permissions. I deferred to this post on how to do so. It ...
34
votes
2answers
16k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
3
votes
2answers
4k views

Roles and permissions: a good approach in defining permissions?

My application has users and administrators. The administrators split into two: super-admin and limited-admin. The super gets all permissions while the limited can be configured to inherit just the ...
2
votes
0answers
212 views

Why do some top projects require write permission on code itself? [closed]

Well this could be a very wide question as every project have different philosophies. But meanwhile question is that We have lot of projects like Yii, Drupal, Apigility which requires full write ...
0
votes
2answers
110 views

Should “special” roles exist in an ARO system?

Right now we're implementing a (honestly overly complex) role-based permissions system where users will be assigned to roles and those roles will be granted permissions on some combination of ...
1
vote
1answer
72 views

Disabling data entry, based on a set of rules [closed]

I work on an application that services a large hospital. The application allows users to create/edit/delete a series of data points that all relate to a specific drug being researched. Once the data ...
2
votes
2answers
261 views

Appropriate developer permissions on a dev server?

Should a senior developer be able to have admin permissions (even if it's on a temporary lease basis) to a development server? I have two specific examples in mind. I'm the dev lead for Java ...
30
votes
6answers
5k views

Dynamic Code Evaluation in Java - Clever or Sloppy?

I am trying to create a flexible ACL framework in Java for my application. Many ACL frameworks are built on a whitelist of rules, where a rule is in the form of owner:action:resource. For example, "...
3
votes
4answers
2k views

Design: How to handle user permissions across a system

My team is currently working on a massive refactor of a medium-sized application in PHP. We are doing our best to refactor our code on a module (Orders, Users, Products) basis. The issue that I am ...
2
votes
1answer
633 views

How to add permissions checks 'after the fact'

I have a great number of PHP classes which perform the business logic of my application, e.g. class FileMaker{ public function makeFile(){ //some code here to make a file } } Now I need to ...
3
votes
2answers
273 views

Recommend an approach to decouple Product and Access code constructs, in order to simplify Product testing

I have some code that tightly couples Product specific code and Product-Access code. I am not sure how to untangle it. So for example, for testing Product, I have to mock up Access objects. And ...
5
votes
1answer
650 views

Designing a better performing total permissions setup for multiple permission levels

We've got a global system that we are attempting to solve a permissions issue around. Currently, our system serves a number of different applications out to our clients and each client has their own ...
3
votes
1answer
277 views

Defining user operations on application/collection+json response?

I'm fairly new to Collection+JSON. I have a bunch of questions regarding Collection+JSON and user operations. Use Case Having user permissions in a Collection+JSON response would be useful in ...
3
votes
1answer
1k views

How to define item level permissions in a relational database

I need to model a database design to provide item level permissions to users based on the user's role access. I am using asp.net with sql server 2012 I am looking at similar experience on how ...
2
votes
0answers
298 views

Handling permissions in a MVP application

In a windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as basically its implementation should be ...
1
vote
2answers
516 views

Hide admin menu if no admin option is available

If you have a menu "Admin tasks" and different admin tasks (like 10) that you could separately assign to each user, but there are users who don't have any admin tasks, how would you deal with "Hiding ...