Questions tagged [permissions]

The tag has no usage guidance.

13 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
144 views

How do large scale permission systems work with membership expansion?

Let's say you have a permission system with which you can specify things like: user U is a member of group A, which is a subgroup of group B, which is a subgroup of group C, and all members of group C ...
3
votes
0answers
711 views

Handling account roles in Android app

I'm building an Android app where different "types" of users can log in - lets say User and Admin are the two roles (there could be more than two). User can access some views in the app, by pressing ...
2
votes
0answers
440 views

Authorization, permissions, and scoping resources in a microservice/DDD architecture

I'm building a microservice-based application (services according to DDD) and am about to implement authorization service. There are API gateways and UI applications that access backend servers, and ...
2
votes
0answers
117 views

Better dynamic user permissions

I support an Internal ERP system and an external Reporting/Dashboard that our customers use that both use the same database. Internal normal application users can control what customers can access ...
2
votes
0answers
316 views

Handling permissions in a MVP application

In a windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as basically its implementation should be ...
0
votes
0answers
22 views

AEM Access Control List (ACL) evaluation

Suppose a user of Adobe AEM is part of 2 groups in the access control list, one with "allow" permission and the other with "deny". Which permission will get applied: "Allow" because it has higher ...
0
votes
0answers
56 views

Is tagging an acceptable way to circumstantially add or remove user permissions in a role-based system?

Background Our users can have a single role per account (internally an IAM domain), but may have roles across multiple accounts. Each role is defined as a list of permissible actions. Problem In ...
0
votes
0answers
173 views

Role Based Access Control on OOP how do you map Permission of Role to Entity?

I've been trying to wrap my mind around this RBAC system. The goal is with a static method from a class, I can get the current user/actor, then check if he has capability to do something for specific ...
0
votes
0answers
45 views

Should a new access control mechanism use a precedence-based or an order-based permission system?

Let's say I have users, groups (or "roles") and resources, and I want to manage various permissions on those resources. As far as I can see, there are two main "philosophies" when it comes to ...
0
votes
0answers
92 views

Pros and cons of setting super admin in users table

I'm structuring a RBAC in a Web system. My database tables looks like: actions id name resources id name permissions id action_id resource_id roles id name permission_role permission_id ...
0
votes
0answers
68 views

Who should be reliable for permissions check in a web app?

I am working on a project where you have controllers that expose an API and services that implement some logic. In this project, each service* checks for the user's permissions to use the service. ...
0
votes
0answers
201 views

Permission Management Algorithm

I have 3 levels of permission to see the product: Brand -> Allow/Deny Category -> Allow/Deny Product -> Allow/Deny For example, product A has: Category: Allow Product: Deny => product A cannot be ...
-1
votes
2answers
148 views

Should I prepopulate resources and permissions in my system?

I am following the rbac model in my system. I want to know if I should prepopulate the resources and permissions table? I have resources like contracts, contract_drafts, SLA (service level agreement)...