Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am setting up a new RESTful web service and I need to provide a role-based access control model. I need to create an architecture that will allow users to provide their username and password to get access to the services and then restrict how they can use the services (which services they can use, read vs read/write, etc) based upon the roles assigned to that users.

I have looked around at other questions and found pieces of what I want. For example there are several great discussions about how to handle passing credentials to REST services restful-authentication, best practices. There are also some great pointers on what programmers should know when creating websites (what every developer should know before building a public web site).

But I haven't been able to find a good post, article, book on best practices and patterns for the software architecture that implements these solutions.

Specifically:

  • How should user details and access rights be stored? (data model, location, format)
  • What are good design patterns for representing and tracking these in the server? (sessions in memory, db lookups each time, etc)
  • What are good patterns for mapping these rights to the services in a secure way in the code base?
  • What architectural choices can help keep the system more secure and reliable?
  • What lessons learned do people have from the trenches?

I am looking for are design patterns and recommendations for the software architecture outside of any specific technologies.

(If the technologies matter, I am planning to implement this using python, twisted, and a postgresql database)

share|improve this question
    
Sounds like you just need someone to write it for you ;) –  Martin Blore Mar 4 '11 at 18:08
    
Unfortunately it looks like way. It just seemed odd that this part of the stack was not described anywhere. Even if I could find a writeup of how a site like newegg, digg, or even even stackoverflow handles user credentials and access in the backend, that would help. –  Allen Mar 4 '11 at 20:36
    
Have you made any progress on this? –  Bryan Agee Aug 1 '12 at 17:04
    
Have you considered oAuth2? There are server and client libraries available for it in many popular languages that should make it easier to implement it. –  Sam Mar 14 at 15:14
add comment

1 Answer 1

OpenAM.

http://forgerock.com/openam.html

How should user details and access rights be stored? (data model, location, format)

Identity Manager. Separate from any web server. LDAP-based.

What are good design patterns for representing and tracking these in the server? (sessions in memory, db lookups each time, etc)

Solved by your framework. Think no more. Just use your framework's already-built good design patterns.

What are good patterns for mapping these rights to the services in a secure way in the code base?

Solved by your framework. Each framework uses a slightly different approach. Each language has slightly different features. Django, for example, uses Python's decorators heavily for this.

What architectural choices can help keep the system more secure and reliable?

More? More than what?

share|improve this answer
    
In my specific setup I don't think I can use something like OpenAM. I don't need enterprise-wide single sign-on. I think I need something smaller and more self-contained. –  Allen Mar 4 '11 at 20:34
    
@Allen. We don't use it for enterprise-wide single sign-on. We use it for simple identity management. –  S.Lott Mar 4 '11 at 20:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.