All Questions

Tagged with
Filter by
Sorted by
Tagged with
0
votes
2answers
56 views

Need suggestions for creating field level permissions which can be changed dynamically in an app

This is currently my User-Role-Permission model in the Db schema (excluded other tables to avoid confusion). My implementation goes like this: I have a Customer table and each Role has a different set ...
0
votes
0answers
45 views

Should a new access control mechanism use a precedence-based or an order-based permission system?

Let's say I have users, groups (or "roles") and resources, and I want to manage various permissions on those resources. As far as I can see, there are two main "philosophies" when it comes to ...
3
votes
0answers
144 views

How do large scale permission systems work with membership expansion?

Let's say you have a permission system with which you can specify things like: user U is a member of group A, which is a subgroup of group B, which is a subgroup of group C, and all members of group C ...
3
votes
4answers
7k views

How to simplify this Role and Permission management design?

I'm working on a web application that has users with multiple roles and each user can perform multiple operations, based on user's role, and the permission level the role has on the operation. I came ...
55
votes
10answers
4k views

What is meant by, “A user shouldn't decide whether it is an Admin or not. The Privileges or Security system should.”

The example used in the question pass bare minimum data to a function touches on the best way to determine whether the user is an administrator or not. One common answer was: user.isAdmin() This ...
4
votes
2answers
452 views

Permissions and MVC

I’m in the progress of developing a web application. This web application is mostly a CRUD interface, although some users are only allowed to perform some actions and see only some parts of views. ...
6
votes
4answers
2k views

How can I create and manage permissions more dynamically?

I want to implement a security system into my web-based Intranet application which allows security administrators to 'fine-tune' exactly what type of access a user/role has to an object. For example, ...