Questions tagged [permissions]
The permissions tag has no usage guidance.
94
questions
0
votes
0
answers
31
views
Cascading ACL to embedded objects
We have an object Root, which references many other objects. Which eventually is translated into FKs on the DB level. We came up with an ACL scheme where there's a separate permissions table with the ...
0
votes
1
answer
69
views
Should I create access control as a microservice or keep the access control logic as part of the specific microservice?
I was wondering if I have a microservice called, for example, Weather, and only certain people can update certain properties around the weather such as Temperature, Precipitation, and Wind.
These ...
1
vote
3
answers
259
views
Is in my case role based access better than permissions?
Hello StackExchange community, I'm in a bit of an impasse for my current project.
The software in question is a collaborative program designed to let employees work together on the platform and assign ...
- 21
0
votes
0
answers
113
views
Deal with users, permission and groups in DDD
I'm struggling when attempting to implement some logic about users and group permissions.
Let's say i have a counter (which represents a group), each counter has an owner and one or more members.
No ...
0
votes
1
answer
92
views
Resource Specific Permissions in Microservice architecture
While building microservice-based architecture I came across a dilemma on how to approach company level permissions for given range (or ids) of resources, i.e. allowing certain users to access subset ...
- 9
4
votes
6
answers
410
views
Best practice to architect a system in which local users may override global definitions
Our travel industry client, operating across three continents and several countries, wants to standardize the process of choosing travel packages, air routes, hotels, and hundreds of other travel ...
- 57
5
votes
2
answers
352
views
Permission Design - Allow/Deny vs Allow Only
I've come onto a new a project and the permissions are done with an allow and a deny option for every permission. Until now i've only ever seen/build allow only permissions.
What is the advantage of ...
- 375
0
votes
1
answer
436
views
RBAC - using database vs hard coded
I need to implement RBAC in a project I'm working on, and I'm fairly new to the concept. I am trying to figure out the best way to implement it.
The most common approach seems to be to create roles ...
- 149
0
votes
2
answers
109
views
Design for generating/filling a document based on a template-file, while considering permissions from a database?
You have the backend for a web application. I'd like to keep this is as disconnected from specific programming lanuages as possible, but if necessary, assume we're talking about PHP.
You need to write ...
- 21
2
votes
4
answers
1k
views
REST API include permissions into resource
We currently have REST API, where you have a set of different resources, like:
GET /cats
GET /cats/{catId}
GET /dogs
Clients decide whether they can perform an action based on resource permissions. ...
0
votes
1
answer
2k
views
Complex roles, permissions and hierarchical group management in Laravel
I'm currently in the planning phase / feasability study of a rather big web application which is meant to be implemented using Laravel.
My own experience on the matter is rather limited but I'd like ...
- 81
2
votes
2
answers
1k
views
Check permissions on top layer before going deeper
I'm building a four layer simple architecture with the following layers:
Controller
Actions and Events
Repositories, that returns single entities or collections
Models, where the SQL code resides
...
2
votes
1
answer
998
views
How to avoid duplicated logic on frontend SPA and backend API
Every time I'm working on an SPA with an API backend I always find myself wondering the best way to do this. The current example I'm running into is as follows:
When a User has their account created ...
- 141
2
votes
2
answers
2k
views
Dealing with property-level permissions in DDD and should UI or authorization influence the domain model?
Suppose I have a command like below:
public sealed class UpdateExampleCommand
{
public int Field1 { get; set; }
public string Field2 { get; set; }
public bool Field3 { get; set; }
...
0
votes
0
answers
75
views
Is tagging an acceptable way to circumstantially add or remove user permissions in a role-based system?
Background
Our users can have a single role per account (internally an IAM domain), but may have roles across multiple accounts.
Each role is defined as a list of permissible actions.
Problem
In ...
- 425
-1
votes
3
answers
697
views
How should I manage SQL Server logins for a desktop application?
I'm looking for a bit of guidance or someone to point me in the right direction.
I have a C# WPF desktop application which accesses a local SQL Server Express database. The application is on a single ...
user326468
0
votes
1
answer
207
views
How to dynamically create and assign user permissions for a group based service
tldr: In building a platform where users can create private groups, and invite other people to those private groups, how is it be to secure those groups?
I'm building a platform around private groups ...
- 133
1
vote
1
answer
4k
views
Check location permissions with MVVM in Android?
I need to request runtime location permissions for the FusedLocationProviderClient api and, once I have them, obtain Location objects and feed them to an algorithm that will make a query to an ...
- 19
2
votes
2
answers
2k
views
How to efficiently pass permissions that control view and access of specific front-end elements from backend to the SPA using JWT
I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT).
Permission Requirement:
...
- 171
0
votes
2
answers
230
views
Need suggestions for creating field level permissions which can be changed dynamically in an app
This is currently my User-Role-Permission model in the Db schema (excluded other tables to avoid confusion). My implementation goes like this: I have a Customer table and each Role has a different set ...
6
votes
1
answer
280
views
How can I clearly present specifications for user permission levels?
I need to write specifications for permissions levels on a system. There are two types of user (Viewer and Editor). Everything a Viewer can do, an Editor can also do. An Editor’s permissions build on ...
- 202
4
votes
1
answer
194
views
What file ownership/permissions should I set for the files/directories before open sourcing a project?
I have multiple projects in different programming languages that I will upload on online code hosting platforms as Open Source projects.
What file permissions and ownerships should I set on the files ...
- 237
3
votes
0
answers
1k
views
Authorization, permissions, and scoping resources in a microservice/DDD architecture
I'm building a microservice-based application (services according to DDD) and am about to implement authorization service. There are API gateways and UI applications that access backend servers, and ...
- 209
0
votes
2
answers
2k
views
Where should permissions be stored in a micro services architecture
We are currently in the process of building a service (a REST API) which is called on by our primary application. The primary application contains a users/permissions/roles set up which is used to ...
- 269
0
votes
0
answers
57
views
Should a new access control mechanism use a precedence-based or an order-based permission system?
Let's say I have users, groups (or "roles") and resources, and I want to manage various permissions on those resources. As far as I can see, there are two main "philosophies" when it comes to ...
- 9,656
0
votes
0
answers
222
views
Pros and cons of setting super admin in users table
I'm structuring a RBAC in a Web system. My database tables looks like:
actions
id
name
resources
id
name
permissions
id
action_id
resource_id
roles
id
name
permission_role
permission_id
...
5
votes
1
answer
6k
views
Dealing with permissions for the list of resource
I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions.
Now I need to build a new service. ...
- 183
36
votes
3
answers
26k
views
Implementing DDD: users and permissions
I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
- 473
1
vote
1
answer
1k
views
REST API for different User Roles in a SAAS application
Need some help in the desing of the Auth/Permissions of a REST API for a SAAS app.
I'd done a prototype of a SAAS app and for permissions of the SAAS client, I'd setup the API to request for a header ...
- 129
3
votes
0
answers
232
views
How do large scale permission systems work with membership expansion?
Let's say you have a permission system with which you can specify things like: user U is a member of group A, which is a subgroup of group B, which is a subgroup of group C, and all members of group C ...
- 170
3
votes
3
answers
2k
views
REST Api - Check if Action is allowed for entity
I'm asking this question for a colleague since he doesn't have enough reputation to post images in a question
During our normal development we found a deficit in our REST Api.
We display entities in ...
- 139
1
vote
1
answer
133
views
Implementing Permissions Control for Related Data Resources
Imagine a data model of an electric company and the city it powers. The company has several departments that manage at least one neighborhood each in the city. The company database includes ...
- 105
1
vote
1
answer
38
views
Access security for user profiles
I have a User Authentication module in my project, that is managing all user information and is regulated with certain granular access rights as Create User, Change User and Delete User. These are ...
- 409
2
votes
1
answer
117
views
Section of program needs root access
I have to perform a number of 'housekeeping' tasks that need root access (Linux, Debian). Generally one time only, but I do need to check that they have been performed.
I don't really want to run the ...
- 131
19
votes
1
answer
5k
views
What is a suggested roadmap towards implementation of a simple Attribute-based access control (ABAC)?
When reading about ACL and RBAC I seem to understand it easily - there are either usernames or roles that are given access to an asset. I can also see how I could implementing those.
i.e. this image ...
- 8,157
-1
votes
2
answers
183
views
Should I prepopulate resources and permissions in my system?
I am following the rbac model in my system.
I want to know if I should prepopulate the resources and permissions table?
I have resources like contracts, contract_drafts, SLA (service level agreement)...
- 379
30
votes
2
answers
44k
views
How to design role based access control?
I am trying to follow the role bases access control model to restrict what users can or cannot do in my system.
So far I have the following entities:
users - People who will use the system. Here I ...
- 379
4
votes
0
answers
864
views
Handling account roles in Android app
I'm building an Android app where different "types" of users can log in - lets say User and Admin are the two roles (there could be more than two). User can access some views in the app, by pressing ...
- 483
9
votes
3
answers
3k
views
How to cleanly implement permission based feature access
I have been tasked with writing an on/off control for features in our product based on who is signed in, in principle with one on/off flag for each feature. Put simply, this is a permission based ...
- 219
1
vote
1
answer
227
views
Controlling permissions for content on web server (pattern/architecture)
I’m working on a proof of concept for a personal project and am unsure how to go about handling ‘permissions’ on content that is uploaded into the application.
Problem:
In this application users ...
- 119
6
votes
2
answers
2k
views
Permission system using PHP and JS
I'm developing an admin dashboard with different areas, where different users may have different permissions. For example:
News
John: edit, view, add, remove;
Carlos: edit, view;
Mario: --;
Support
...
- 291
3
votes
3
answers
2k
views
How to keep database user permissions under source control
I use liquibase for source control of our database. I put there changes to the schema, static data and procedures. So far I've kept permissions out of it; we have just four users with very well ...
- 1,607
1
vote
1
answer
62
views
One shared account for running CI infrastructure?
Should I set up a shared account in our CI infrastructure to make it easier to use?
My team uses CI infrastructure. When a developer first sets up a build he must enter his source control credentials ...
- 6,470
3
votes
1
answer
2k
views
Extending ACL with more sophisticated rules in web REST API
I am currently working a REST API design and I am looking for a way to add an advanced ACL management, beyond what
Let's consider for instance that I have a route which is the following :
/profile/...
- 241
3
votes
4
answers
5k
views
How to keep permissions of users in a database?
What is the accepted way of keeping track of a user's permissions in a database? Say I have a web app where users can pay for privileges. To use a straightforward analogy, imagine Github's users (...
- 141
1
vote
1
answer
3k
views
Managing permissions in hierarchical groups
I'm currently writing a web application for our small company which was originally just planned to organize appointments more efficiently by displaying our customer structure and automatically plan ...
- 81
1
vote
1
answer
951
views
Adding support for privileges to an ASP.NET MVC application already supporting roles based authorization
I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to ...
- 137
8
votes
4
answers
4k
views
Correct Way to Implementing Authorization Checks in ASP MVC
In ASP MVC we have the Authorize attribute to perform check at either a controller level or at a controller method level. But what if you need to do check permissions inside a controller method e.g ...
- 291
2
votes
1
answer
676
views
Should I make myself a superadmin?
I am currently developing a web application (in Ruby on Rails) for my university's department. The web application's user base have several roles: director (the director and assistant director of the ...
- 2,984
6
votes
4
answers
14k
views
How to simplify this Role and Permission management design?
I'm working on a web application that has users with multiple roles and each user can perform multiple operations, based on user's role, and the permission level the role has on the operation. I came ...
- 613