The Stack Overflow podcast is back! Listen to an interview with our new CEO.

All Questions

Filter by
Sorted by
Tagged with
2
votes
2answers
100 views

Dealing with property-level permissions in DDD and should UI or authorization influence the domain model?

Suppose I have a command like below: public sealed class UpdateExampleCommand { public int Field1 { get; set; } public string Field2 { get; set; } public bool Field3 { get; set; } ...
1
vote
2answers
112 views

Permission Based Access Control with JWT

I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT). Permission Requirement: ...
1
vote
0answers
389 views

Authorization, permissions, and scoping resources in a microservice/DDD architecture

I'm building a microservice-based application (services according to DDD) and am about to implement authorization service. There are API gateways and UI applications that access backend servers, and ...
5
votes
1answer
4k views

Dealing with permissions for the list of resource

I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions. Now I need to build a new service. ...
13
votes
2answers
6k views

Implementing DDD: users and permissions

I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
-1
votes
2answers
138 views

Should I prepopulate resources and permissions in my system?

I am following the rbac model in my system. I want to know if I should prepopulate the resources and permissions table? I have resources like contracts, contract_drafts, SLA (service level agreement)...
13
votes
2answers
23k views

How to design role based access control?

I am trying to follow the role bases access control model to restrict what users can or cannot do in my system. So far I have the following entities: users - People who will use the system. Here I ...
1
vote
1answer
846 views

Adding support for privileges to an ASP.NET MVC application already supporting roles based authorization

I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to ...
7
votes
4answers
2k views

Correct Way to Implementing Authorization Checks in ASP MVC

In ASP MVC we have the Authorize attribute to perform check at either a controller level or at a controller method level. But what if you need to do check permissions inside a controller method e.g ...
44
votes
2answers
21k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
0
votes
2answers
123 views

Should “special” roles exist in an ARO system?

Right now we're implementing a (honestly overly complex) role-based permissions system where users will be assigned to roles and those roles will be granted permissions on some combination of ...
13
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
7
votes
2answers
4k views

Examples of permission-based authorization systems in .NET? [closed]

I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems (...