Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access rights against them. Then assign the users the roles.

Though I find the role based method quite flexible and easy to maintain I am still interested to know whether there are any better methods for storing authorization details.

I am using Spring Security for securing JSF web applications. Along with solutions for Spring Security I would also appreciate general solutions (not specific to a particular security framework).

share|improve this question

There's Context-based access control.

In contrast to plain RBAC, CBAC also looks at the situation's context.

An example of a website which uses that is, which students usually can access without identification from within their university's network but not from home, even though in both scenarios they are in the role of an "unidentified visitor".

share|improve this answer

Roles are probably the most common. Make sure you don't use security roles for other purposes in your application. For example if you want a list of managers and you happen to have a manager security role, don't use it. You may eventually split this group up for security purposes, but still need all of them to be identified as a manager in the application.

share|improve this answer
The OP specifically asked for different ways. The hint about reuse should probably be a comment as it's not directly answering the question. – blubb Aug 4 '11 at 15:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.