Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm in the process of designing the access control portion of a moderately complex application, but I feel like I'm re-discovering a lot of wheels.

Does there exist a good overview of the "access control" domain, including terminology, discussion of the tradeoffs of different schemes (RBAC, ACL, ???), how it interacts with business policy ("Alice can only access the coffee machine before 11:30"), and possibly implementation suggestions?

Sorry if this question is a bit vague. I'm still in the "I sort of know what I want to accomplish, but I don't know very much about the domain or terminology".

share|improve this question
    
Perhaps you could give us more insight on your project. Is it in Windows? Linux? MacOSX? Networked? –  David Thornley Jan 5 '12 at 22:54
    
Ah, sorry. I'm working on a browser-based application that will be to manage, schedule and report on advertising-related content. There will be different conceptual classes of user - content producers, content schedulers, managers (who want to see reports and the like) from different organizations, so you can approximate the kind of restrictions I'll be implementing. –  David Wolever Jan 5 '12 at 23:53
    
Whatever you do, you should make sure to watch Zed Shaw tell you why the ACL is dead: vimeo.com/2723800 –  Wyatt Barnett Jan 6 '12 at 21:30
    
I was in the audience when that talk was given :) –  David Wolever Jan 6 '12 at 22:15

1 Answer 1

Take a look at a security framework such as Spring Security; Spring Security in particular implements a lot of usual security requirements, has good documentation and I suspect well-engineered code (at least Sprinc Core has). You might be able to find a similar framework for your platform of choice, of course.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.