I am setting up a new RESTful web service and I need to provide a role-based access control model. I need to create an architecture that will allow users to provide their username and password to get access to the services and then restrict how they can use the services (which services they can use, read vs read/write, etc) based upon the roles assigned to that users.
I have looked around at other questions and found pieces of what I want. For example there are several great discussions about how to handle passing credentials to REST services restful-authentication, best practices. There are also some great pointers on what programmers should know when creating websites (what every developer should know before building a public web site).
But I haven't been able to find a good post, article, book on best practices and patterns for the software architecture that implements these solutions.
- How should user details and access rights be stored? (data model, location, format)
- What are good design patterns for representing and tracking these in the server? (sessions in memory, db lookups each time, etc)
- What are good patterns for mapping these rights to the services in a secure way in the code base?
- What architectural choices can help keep the system more secure and reliable?
- What lessons learned do people have from the trenches?
I am looking for are design patterns and recommendations for the software architecture outside of any specific technologies.
(If the technologies matter, I am planning to implement this using python, twisted, and a postgresql database)