Questions tagged [permissions]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
55
votes
10answers
4k views

What is meant by, “A user shouldn't decide whether it is an Admin or not. The Privileges or Security system should.”

The example used in the question pass bare minimum data to a function touches on the best way to determine whether the user is an administrator or not. One common answer was: user.isAdmin() This ...
45
votes
2answers
23k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
38
votes
5answers
6k views

What's the word for an operation that can be applied multiple times and never change state beyond the initial application?

I'm trying to remember a word, I think it's related to computational or database theory. The closest synonym is atomic but that's not exactly it. Basically it's a kind of computation that should ...
30
votes
6answers
6k views

Dynamic Code Evaluation in Java - Clever or Sloppy?

I am trying to create a flexible ACL framework in Java for my application. Many ACL frameworks are built on a whitelist of rules, where a rule is in the form of owner:action:resource. For example, "...
26
votes
5answers
17k views

Where should user permission checks take place in and MVC and by who?

Should user permission checks take place in the model or the controller? And who should handle the permission checks, the User object or some UserManagement helper? Where should it happen? Checking ...
16
votes
2answers
7k views

Implementing DDD: users and permissions

I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
14
votes
2answers
25k views

How to design role based access control?

I am trying to follow the role bases access control model to restrict what users can or cannot do in my system. So far I have the following entities: users - People who will use the system. Here I ...
13
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
11
votes
1answer
3k views

What is a suggested roadmap towards implementation of a simple Attribute-based access control (ABAC)?

When reading about ACL and RBAC I seem to understand it easily - there are either usernames or roles that are given access to an asset. I can also see how I could implementing those. i.e. this image ...
7
votes
3answers
1k views

How to cleanly implement permission based feature access

I have been tasked with writing an on/off control for features in our product based on who is signed in, in principle with one on/off flag for each feature. Put simply, this is a permission based ...
7
votes
5answers
1k views

Filesystem like permissions for C++ type-members

Abstract (tl;dr) Please read the full question, this is awfully simplified: How can unix file permission style restrictions be applied to inter-type data/control flows, allowing fine-grained access ...
7
votes
4answers
3k views

Correct Way to Implementing Authorization Checks in ASP MVC

In ASP MVC we have the Authorize attribute to perform check at either a controller level or at a controller method level. But what if you need to do check permissions inside a controller method e.g ...
7
votes
2answers
4k views

Examples of permission-based authorization systems in .NET? [closed]

I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems (...
6
votes
4answers
2k views

How can I create and manage permissions more dynamically?

I want to implement a security system into my web-based Intranet application which allows security administrators to 'fine-tune' exactly what type of access a user/role has to an object. For example, ...
6
votes
2answers
936 views

Permission system using PHP and JS

I'm developing an admin dashboard with different areas, where different users may have different permissions. For example: News John: edit, view, add, remove; Carlos: edit, view; Mario: --; Support ...
6
votes
2answers
3k views

Copyright Laws for Apps

For my app that I'm about to release, I have used a bunch of 3rd party classes found for free online. I checked all the liscenses before using the code and each one said I could use the code ...
6
votes
1answer
138 views

How can I clearly present specifications for user permission levels?

I need to write specifications for permissions levels on a system. There are two types of user (Viewer and Editor). Everything a Viewer can do, an Editor can also do. An Editor’s permissions build on ...
5
votes
1answer
4k views

Dealing with permissions for the list of resource

I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions. Now I need to build a new service. ...
5
votes
1answer
210 views

Reasons not to have flexible role management system

Our .NET web application has the ability to add roles dynamically and assign functionalities (we define them in an application enum) to that role. So those functionalities are defined by us (our ...
5
votes
4answers
3k views

Design: How to handle user permissions across a system

My team is currently working on a massive refactor of a medium-sized application in PHP. We are doing our best to refactor our code on a module (Orders, Users, Products) basis. The issue that I am ...
5
votes
5answers
346 views

How do you keep logins organized between multiple developers?

I've worked at several places with 2-10 developers and each place has struggled in the area of tracking if the company has an account on a given web site or service. We're always left wondering... ...
5
votes
1answer
830 views

Designing a better performing total permissions setup for multiple permission levels

We've got a global system that we are attempting to solve a permissions issue around. Currently, our system serves a number of different applications out to our clients and each client has their own ...
4
votes
1answer
179 views

What file ownership/permissions should I set for the files/directories before open sourcing a project?

I have multiple projects in different programming languages that I will upload on online code hosting platforms as Open Source projects. What file permissions and ownerships should I set on the files ...
4
votes
2answers
5k views

Roles and permissions: a good approach in defining permissions?

My application has users and administrators. The administrators split into two: super-admin and limited-admin. The super gets all permissions while the limited can be configured to inherit just the ...
4
votes
2answers
950 views

What kind of permission is this? (Groups+Roles)

I'm starting to need an access control for roles in my app. I don't know much of this, but I understand how vBulletin works: I create groups, then give permissions to groups. I think that what I ...
4
votes
2answers
452 views

Permissions and MVC

I’m in the progress of developing a web application. This web application is mostly a CRUD interface, although some users are only allowed to perform some actions and see only some parts of views. ...
3
votes
1answer
2k views

How to define item level permissions in a relational database

I need to model a database design to provide item level permissions to users based on the user's role access. I am using asp.net with sql server 2012 I am looking at similar experience on how ...
3
votes
3answers
821 views

REST Api - Check if Action is allowed for entity

I'm asking this question for a colleague since he doesn't have enough reputation to post images in a question During our normal development we found a deficit in our REST Api. We display entities in ...
3
votes
4answers
7k views

How to simplify this Role and Permission management design?

I'm working on a web application that has users with multiple roles and each user can perform multiple operations, based on user's role, and the permission level the role has on the operation. I came ...
3
votes
3answers
1k views

How to keep database user permissions under source control

I use liquibase for source control of our database. I put there changes to the schema, static data and procedures. So far I've kept permissions out of it; we have just four users with very well ...
3
votes
1answer
281 views

Defining user operations on application/collection+json response?

I'm fairly new to Collection+JSON. I have a bunch of questions regarding Collection+JSON and user operations. Use Case Having user permissions in a Collection+JSON response would be useful in ...
3
votes
1answer
1k views

Extending ACL with more sophisticated rules in web REST API

I am currently working a REST API design and I am looking for a way to add an advanced ACL management, beyond what Let's consider for instance that I have a route which is the following : /profile/...
3
votes
2answers
275 views

Recommend an approach to decouple Product and Access code constructs, in order to simplify Product testing

I have some code that tightly couples Product specific code and Product-Access code. I am not sure how to untangle it. So for example, for testing Product, I have to mock up Access objects. And ...
3
votes
0answers
144 views

How do large scale permission systems work with membership expansion?

Let's say you have a permission system with which you can specify things like: user U is a member of group A, which is a subgroup of group B, which is a subgroup of group C, and all members of group C ...
3
votes
0answers
711 views

Handling account roles in Android app

I'm building an Android app where different "types" of users can log in - lets say User and Admin are the two roles (there could be more than two). User can access some views in the app, by pressing ...
2
votes
4answers
2k views

How to keep permissions of users in a database?

What is the accepted way of keeping track of a user's permissions in a database? Say I have a web app where users can pay for privileges. To use a straightforward analogy, imagine Github's users (...
2
votes
1answer
124 views

How to avoid duplicated logic on frontend SPA and backend API

Every time I'm working on an SPA with an API backend I always find myself wondering the best way to do this. The current example I'm running into is as follows: When a User has their account created ...
2
votes
2answers
182 views

Dealing with property-level permissions in DDD and should UI or authorization influence the domain model?

Suppose I have a command like below: public sealed class UpdateExampleCommand { public int Field1 { get; set; } public string Field2 { get; set; } public bool Field3 { get; set; } ...
2
votes
1answer
376 views

Should I make myself a superadmin?

I am currently developing a web application (in Ruby on Rails) for my university's department. The web application's user base have several roles: director (the director and assistant director of the ...
2
votes
1answer
146 views

What kind of security enforces a tree of permissions on it's users?

I'm looking for a name or design pattern on an ACL Based permission system (at least, I think it has some features of ACL). The case An admin is allowed to create Managers. These managers will be ...
2
votes
1answer
801 views

How to add permissions checks 'after the fact'

I have a great number of PHP classes which perform the business logic of my application, e.g. class FileMaker{ public function makeFile(){ //some code here to make a file } } Now I need to ...
2
votes
2answers
316 views

Appropriate developer permissions on a dev server?

Should a senior developer be able to have admin permissions (even if it's on a temporary lease basis) to a development server? I have two specific examples in mind. I'm the dev lead for Java ...
2
votes
2answers
1k views

Fine-grained data level permissions on a laravel RESTful API

The problem: We want to restrict access to properties returned from our services. Details: We have route level permissions working with no issue. For a user that can view /product/{id} for example,...
2
votes
1answer
224 views

Design Application to “Actively” Invite Users (pretend they have privileges)

I am designing an application where users message one another privately, and may send messages to any Entity in the database (an Entity may not have a user account yet, it is a professional database). ...
2
votes
1answer
183 views

What is a good overview of options for access controls/permissions?

I'm in the process of designing the access control portion of a moderately complex application, but I feel like I'm re-discovering a lot of wheels. Does there exist a good overview of the "access ...
2
votes
0answers
439 views

Authorization, permissions, and scoping resources in a microservice/DDD architecture

I'm building a microservice-based application (services according to DDD) and am about to implement authorization service. There are API gateways and UI applications that access backend servers, and ...
2
votes
0answers
117 views

Better dynamic user permissions

I support an Internal ERP system and an external Reporting/Dashboard that our customers use that both use the same database. Internal normal application users can control what customers can access ...
2
votes
0answers
219 views

Why do some top projects require write permission on code itself? [closed]

Well this could be a very wide question as every project have different philosophies. But meanwhile question is that We have lot of projects like Yii, Drupal, Apigility which requires full write ...
2
votes
0answers
316 views

Handling permissions in a MVP application

In a windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as basically its implementation should be ...
1
vote
2answers
162 views

How to represent complex permissions system in single hash or set of characters?

Eve Online, a game I used to play, had an interesting "permissions" system for account interactions with other apps. The permissions encompassed dozens of individual permissions, each under a ...