Questions tagged [permissions]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
6
votes
1answer
138 views

How can I clearly present specifications for user permission levels?

I need to write specifications for permissions levels on a system. There are two types of user (Viewer and Editor). Everything a Viewer can do, an Editor can also do. An Editor’s permissions build on ...
3
votes
1answer
2k views

How to define item level permissions in a relational database

I need to model a database design to provide item level permissions to users based on the user's role access. I am using asp.net with sql server 2012 I am looking at similar experience on how ...
1
vote
4answers
98 views

REST API include permissions into resource

We currently have REST API, where you have a set of different resources, like: GET /cats GET /cats/{catId} GET /dogs Clients decide whether they can perform an action based on resource permissions. ...
0
votes
1answer
123 views

Complex roles, permissions and hierarchical group management in Laravel

I'm currently in the planning phase / feasability study of a rather big web application which is meant to be implemented using Laravel. My own experience on the matter is rather limited but I'd like ...
0
votes
0answers
22 views

AEM Access Control List (ACL) evaluation

Suppose a user of Adobe AEM is part of 2 groups in the access control list, one with "allow" permission and the other with "deny". Which permission will get applied: "Allow" because it has higher ...
1
vote
2answers
120 views

Check permissions on top layer before going deeper

I'm building a four layer simple architecture with the following layers: Controller Actions and Events Repositories, that returns single entities or collections Models, where the SQL code resides ...
0
votes
1answer
144 views

What is a good approach for permissions of this application's users?

I have an app that have multiple users. In my app an user can - create contacts (people) - edit contacts - view contacts - create an entry to agenda - view entry from agenda Also I need that User A ...
2
votes
1answer
123 views

How to avoid duplicated logic on frontend SPA and backend API

Every time I'm working on an SPA with an API backend I always find myself wondering the best way to do this. The current example I'm running into is as follows: When a User has their account created ...
2
votes
2answers
175 views

Dealing with property-level permissions in DDD and should UI or authorization influence the domain model?

Suppose I have a command like below: public sealed class UpdateExampleCommand { public int Field1 { get; set; } public string Field2 { get; set; } public bool Field3 { get; set; } ...
0
votes
1answer
593 views

Check location permissions with MVVM in Android?

I need to request runtime location permissions for the FusedLocationProviderClient api and, once I have them, obtain Location objects and feed them to an algorithm that will make a query to an ...
0
votes
0answers
56 views

Is tagging an acceptable way to circumstantially add or remove user permissions in a role-based system?

Background Our users can have a single role per account (internally an IAM domain), but may have roles across multiple accounts. Each role is defined as a list of permissible actions. Problem In ...
-1
votes
3answers
117 views

How should I manage SQL Server logins for a desktop application?

I'm looking for a bit of guidance or someone to point me in the right direction. I have a C# WPF desktop application which accesses a local SQL Server Express database. The application is on a single ...
0
votes
1answer
28 views

How to dynamically create and assign user permissions for a group based service

tldr: In building a platform where users can create private groups, and invite other people to those private groups, how is it be to secure those groups? I'm building a platform around private groups ...
0
votes
2answers
56 views

Need suggestions for creating field level permissions which can be changed dynamically in an app

This is currently my User-Role-Permission model in the Db schema (excluded other tables to avoid confusion). My implementation goes like this: I have a Customer table and each Role has a different set ...
1
vote
2answers
347 views

Permission Based Access Control with JWT

I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT). Permission Requirement: ...
4
votes
1answer
179 views

What file ownership/permissions should I set for the files/directories before open sourcing a project?

I have multiple projects in different programming languages that I will upload on online code hosting platforms as Open Source projects. What file permissions and ownerships should I set on the files ...
0
votes
0answers
172 views

Role Based Access Control on OOP how do you map Permission of Role to Entity?

I've been trying to wrap my mind around this RBAC system. The goal is with a static method from a class, I can get the current user/actor, then check if he has capability to do something for specific ...
2
votes
0answers
437 views

Authorization, permissions, and scoping resources in a microservice/DDD architecture

I'm building a microservice-based application (services according to DDD) and am about to implement authorization service. There are API gateways and UI applications that access backend servers, and ...
0
votes
2answers
314 views

Where should permissions be stored in a micro services architecture

We are currently in the process of building a service (a REST API) which is called on by our primary application. The primary application contains a users/permissions/roles set up which is used to ...
3
votes
4answers
7k views

How to simplify this Role and Permission management design?

I'm working on a web application that has users with multiple roles and each user can perform multiple operations, based on user's role, and the permission level the role has on the operation. I came ...
0
votes
0answers
45 views

Should a new access control mechanism use a precedence-based or an order-based permission system?

Let's say I have users, groups (or "roles") and resources, and I want to manage various permissions on those resources. As far as I can see, there are two main "philosophies" when it comes to ...
0
votes
0answers
91 views

Pros and cons of setting super admin in users table

I'm structuring a RBAC in a Web system. My database tables looks like: actions id name resources id name permissions id action_id resource_id roles id name permission_role permission_id ...
5
votes
1answer
4k views

Dealing with permissions for the list of resource

I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions. Now I need to build a new service. ...
2
votes
2answers
1k views

Fine-grained data level permissions on a laravel RESTful API

The problem: We want to restrict access to properties returned from our services. Details: We have route level permissions working with no issue. For a user that can view /product/{id} for example,...
1
vote
1answer
477 views

REST API for different User Roles in a SAAS application

Need some help in the desing of the Auth/Permissions of a REST API for a SAAS app. I'd done a prototype of a SAAS app and for permissions of the SAAS client, I'd setup the API to request for a header ...
15
votes
2answers
7k views

Implementing DDD: users and permissions

I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
3
votes
0answers
144 views

How do large scale permission systems work with membership expansion?

Let's say you have a permission system with which you can specify things like: user U is a member of group A, which is a subgroup of group B, which is a subgroup of group C, and all members of group C ...
3
votes
3answers
820 views

REST Api - Check if Action is allowed for entity

I'm asking this question for a colleague since he doesn't have enough reputation to post images in a question During our normal development we found a deficit in our REST Api. We display entities in ...
1
vote
1answer
93 views

Implementing Permissions Control for Related Data Resources

Imagine a data model of an electric company and the city it powers. The company has several departments that manage at least one neighborhood each in the city. The company database includes ...
38
votes
5answers
6k views

What's the word for an operation that can be applied multiple times and never change state beyond the initial application?

I'm trying to remember a word, I think it's related to computational or database theory. The closest synonym is atomic but that's not exactly it. Basically it's a kind of computation that should ...
1
vote
1answer
35 views

Access security for user profiles

I have a User Authentication module in my project, that is managing all user information and is regulated with certain granular access rights as Create User, Change User and Delete User. These are ...
1
vote
1answer
91 views

Section of program needs root access

I have to perform a number of 'housekeeping' tasks that need root access (Linux, Debian). Generally one time only, but I do need to check that they have been performed. I don't really want to run the ...
11
votes
1answer
3k views

What is a suggested roadmap towards implementation of a simple Attribute-based access control (ABAC)?

When reading about ACL and RBAC I seem to understand it easily - there are either usernames or roles that are given access to an asset. I can also see how I could implementing those. i.e. this image ...
-1
votes
2answers
147 views

Should I prepopulate resources and permissions in my system?

I am following the rbac model in my system. I want to know if I should prepopulate the resources and permissions table? I have resources like contracts, contract_drafts, SLA (service level agreement)...
14
votes
2answers
25k views

How to design role based access control?

I am trying to follow the role bases access control model to restrict what users can or cannot do in my system. So far I have the following entities: users - People who will use the system. Here I ...
1
vote
1answer
145 views

Controlling permissions for content on web server (pattern/architecture)

I’m working on a proof of concept for a personal project and am unsure how to go about handling ‘permissions’ on content that is uploaded into the application. Problem: In this application users ...
3
votes
0answers
708 views

Handling account roles in Android app

I'm building an Android app where different "types" of users can log in - lets say User and Admin are the two roles (there could be more than two). User can access some views in the app, by pressing ...
7
votes
3answers
1k views

How to cleanly implement permission based feature access

I have been tasked with writing an on/off control for features in our product based on who is signed in, in principle with one on/off flag for each feature. Put simply, this is a permission based ...
1
vote
1answer
877 views

Adding support for privileges to an ASP.NET MVC application already supporting roles based authorization

I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to ...
7
votes
4answers
3k views

Correct Way to Implementing Authorization Checks in ASP MVC

In ASP MVC we have the Authorize attribute to perform check at either a controller level or at a controller method level. But what if you need to do check permissions inside a controller method e.g ...
3
votes
3answers
1k views

How to keep database user permissions under source control

I use liquibase for source control of our database. I put there changes to the schema, static data and procedures. So far I've kept permissions out of it; we have just four users with very well ...
3
votes
1answer
281 views

Defining user operations on application/collection+json response?

I'm fairly new to Collection+JSON. I have a bunch of questions regarding Collection+JSON and user operations. Use Case Having user permissions in a Collection+JSON response would be useful in ...
3
votes
1answer
1k views

Extending ACL with more sophisticated rules in web REST API

I am currently working a REST API design and I am looking for a way to add an advanced ACL management, beyond what Let's consider for instance that I have a route which is the following : /profile/...
6
votes
2answers
935 views

Permission system using PHP and JS

I'm developing an admin dashboard with different areas, where different users may have different permissions. For example: News John: edit, view, add, remove; Carlos: edit, view; Mario: --; Support ...
1
vote
1answer
55 views

One shared account for running CI infrastructure?

Should I set up a shared account in our CI infrastructure to make it easier to use? My team uses CI infrastructure. When a developer first sets up a build he must enter his source control credentials ...
2
votes
2answers
315 views

Appropriate developer permissions on a dev server?

Should a senior developer be able to have admin permissions (even if it's on a temporary lease basis) to a development server? I have two specific examples in mind. I'm the dev lead for Java ...
2
votes
4answers
2k views

How to keep permissions of users in a database?

What is the accepted way of keeping track of a user's permissions in a database? Say I have a web app where users can pay for privileges. To use a straightforward analogy, imagine Github's users (...
1
vote
1answer
2k views

Managing permissions in hierarchical groups

I'm currently writing a web application for our small company which was originally just planned to organize appointments more efficiently by displaying our customer structure and automatically plan ...
7
votes
5answers
1k views

Filesystem like permissions for C++ type-members

Abstract (tl;dr) Please read the full question, this is awfully simplified: How can unix file permission style restrictions be applied to inter-type data/control flows, allowing fine-grained access ...
2
votes
1answer
373 views

Should I make myself a superadmin?

I am currently developing a web application (in Ruby on Rails) for my university's department. The web application's user base have several roles: director (the director and assistant director of the ...