Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I want to implement a security system into my web-based Intranet application which allows security administrators to 'fine-tune' exactly what type of access a user/role has to an object. For example, an ACL-based solution might allow a receptionist access to Create, Read and Update an appointment but not Delete it, similarly I might be able to let user Bob only Read or Comment on a company memo, but not Create, Update or Delete them.

However, how would I go about allowing a receptionist only to make appointments within opening hours? How would I restrict appointments to dates from today to one month from now? What about Bob - how would I let him Create a memo after he had gained enough 'respect' points (a bit like on here).

Crucially, how can I keep these values dynamic (opening hours, date restrictions, respect points, some new constraint) so that I don't hard-code them into the application? Can anyone recommend a method (or framework, book to read etc) so that I can let the administrator create and manage these roles and their constraints rather than the programmer?

The existing ACL and role-based systems I've seen don't seem to offer any way to deal with constraints - you either have access or you don't!

Thanks

share|improve this question

3 Answers 3

You could simply add methods to your user object:

public boolean makeAppointmentsWhileOpen(Date d) {
    return this.makeAnyAppointment || isBusinessHour(d) < 30;
}

public boolean makeAppointmentFor(Date d) {
    return this.makeAnyAppointment ||
           (daysDiff(d, today) < 30);
}
public boolean createMemo() {
    return this.reputationPoints >= MIN_MEMO_POINTS;
}

What I'm saying is that you don't need a framework to model permissions rules. If a framework works for your needs, that's great. If it doesn't, just add the necessary fields to your user database table or calculate permissions on-the-fly from other fields as above.

As with any permissions system, testing is critical.

share|improve this answer

As @victor has pointed out. rule-based authorization systems allow you to fine-tune access to your users' actions by controlling arbitrary attributes for each user.

in the ruby on rails world there is e.g. declarative_authorization that can serve as an example on how the rules interact with the roles your users have. you can take it as an example on what can be be done and how to use rule-based authorization in a MVC framework.

regarding dynamic rules: you can read any data-source during authorization check (e.g. opening hours in a 'settings' table in your database).

NB: rule-based systems can get very complex really fast when adding rules (and/or roles). so, thorough (automated) testing is the way to go.

share|improve this answer

I don't know what frameworks are available for the technologies you use but as a generic solution you could use a rule based system to express and evaluate permissions.

The rules could be something like:

IF CurrentUser.IsInRole("Receptionists") AND CurrentTime.IsOpeningHour() 
THEN GrantSomePermission()

IF CurrentUser.IsManager() OR (CurrentUser.IsLead() AND CurrentUser.NotInGroup("X"))
THEN DenySomething()

The admin would need to create them. This could be either through a minimalistic language and editor or through a simple UI similar to the ones where you build queries (add conditions, group them, select operators, etc.).

The drawback of such an approach is finding the issue when something goes wrong. Debugging such rules might be tricky. Also, execution order of the rules could be a challenge.

share|improve this answer
1  
@boatingcow If you're using Java, Drools is an example of one of these rule based systems. –  Daniel Kaplan Jan 7 '13 at 18:19
    
Thanks for the tip on Drools :) –  boatingcow Jan 8 '13 at 13:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.