Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access rights against them. Then assign the users the roles.

Though I find the role based method quite flexible and easy to maintain I am still interested to know whether there are any better methods for storing authorization details.

I am using Spring Security for securing JSF web applications. Along with solutions for Spring Security I would also appreciate general solutions (not specific to a particular security framework).

share|improve this question
add comment

2 Answers 2

There's Context-based access control.

In contrast to plain RBAC, CBAC also looks at the situation's context.

An example of a website which uses that is safaribooksonline.com, which students usually can access without identification from within their university's network but not from home, even though in both scenarios they are in the role of an "unidentified visitor".

share|improve this answer
add comment

Roles are probably the most common. Make sure you don't use security roles for other purposes in your application. For example if you want a list of managers and you happen to have a manager security role, don't use it. You may eventually split this group up for security purposes, but still need all of them to be identified as a manager in the application.

share|improve this answer
2  
The OP specifically asked for different ways. The hint about reuse should probably be a comment as it's not directly answering the question. –  blubb Aug 4 '11 at 15:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.