The tag has no usage guidance.

learn more… | top users | synonyms

4
votes
1answer
44 views

How to structure path-colliding REST webservices with role-access

I have a bunch of REST webservices that my client uses. For instance, to create a user, I have POST /users and to modify it POST /users/{id} The problem is, some fields, as marketArea, are ...
0
votes
2answers
91 views

Should “special” roles exist in an ARO system?

Right now we're implementing a (honestly overly complex) role-based permissions system where users will be assigned to roles and those roles will be granted permissions on some combination of ...
2
votes
1answer
57 views

What kind of security enforces a tree of permissions on it's users?

I'm looking for a name or design pattern on an ACL Based permission system (at least, I think it has some features of ACL). The case An admin is allowed to create Managers. These managers will be ...
6
votes
1answer
2k views

Standard practices for access control (design pattern)

I'm looking at my interface design and I am struggling to decide which is the most "correct" way to implement role-based access control, given a user and a subject that the user would like to access. ...
0
votes
2answers
2k views

How to implement a hybrid role-based access control model?

I am writing an enterprise web-forms-frontend application for in-house use. It has Direct access control (DAC) masquerading as Role-based access control (RBAC). For anonymization purposes, let's ...
11
votes
2answers
2k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a ...
2
votes
1answer
77 views

Centralize permission evaluation

I am looking for a viable design/architecture pattern for securing several web applications. Here is the situation: Multiple web applications must enforce roles and permissions at Java service ...
3
votes
3answers
192 views

How do I recreate this Access Control/Group/ whatever methodology in OO/MVC

I am looking at trying to rewrite an application that is mostly procedural to an MVC/OO approach in order to teach myself a deeper understanding of both. BUT, I am having some conceptual issues with ...
1
vote
1answer
81 views

REST API and user rights

I am developing an application using Angular and REST API and I'm facing a problem concerning user access right. The application runs this way: A user signup The same user creates his organization ...
0
votes
0answers
24 views

Identity & access management for multiple systems

I develop niche business applications for the company I work for but I'm really starting to feel like I need to look at a single shared Identity & Access Management (IAM) server approach as we are ...
1
vote
2answers
281 views

PHP MVC how to access current user?

What is the best way to tell if a user is already logged in when accessing the page? I have seen many people talk about a Recognition service that will validate a user trying to login, but what about ...
27
votes
6answers
4k views

Dynamic Code Evaluation in Java - Clever or Sloppy?

I am trying to create a flexible ACL framework in Java for my application. Many ACL frameworks are built on a whitelist of rules, where a rule is in the form of owner:action:resource. For example, ...
11
votes
4answers
440 views

When should a private method take the public route to access private data?

When should a private method take the public route to access private data? For example, if I had this immutable 'multiplier' class (a bit contrived, I know): class Multiplier { public: ...
1
vote
1answer
142 views

How can I simplify the following Access Control system design?

I couldn't find a better title for this... I am trying to create an Access Control for my application and I am having serious trouble with building not an insane system, mainly for performance as ...
-1
votes
1answer
204 views

mongoDB user management (built in or own implementation) [closed]

I started to evaluate mongoDB for a product catalogue. Regarding user management and access control: When to use the mongoDB's built in user management and when build one on the application layer? ...
2
votes
1answer
52 views

Privilege (Access/Permission) Control for Hierarchial Structured Resource

Question: Is there any standard model or industry defacto implementation for modeling and implementing Access Control in (i.e.) a Document Management System? Note: I studied a bit the security ...
2
votes
1answer
161 views

Embedding XACML PDP?

I need to implement a flexible Access Control system for a framework used by a couple of .NET applications. I have looked into Attribute-Based Access Control (ABAC) and XACML and this seems to ...
0
votes
2answers
2k views

Is it a good idea to const-qualify the fields of structure in C?

Consider the following program: #include <stdlib.h> #include <stdio.h> typedef struct S_s { const int _a; } S_t; S_t * create_S(void) { return calloc(sizeof(S_t), 1); } void ...
2
votes
1answer
389 views

Restrictive routing best practices for Google App Engine with python?

Say I have a simple structure: app = webapp2.WSGIApplication([ (r'/', 'pages.login'), (r'/profile', 'pages.profile'), (r'/dashboard', 'pages.dash'), ], debug=True) Basically all pages ...
0
votes
1answer
141 views

Using a Proxy as an ACL

I am building an MVC application in PHP, using Zend Framework. My model includes Domain Model and Mapper layers. I am trying to keep the domain model in pristine condition and have managed to keep ...
1
vote
0answers
146 views

Using a Finite State Machine for access management?

My intranet site uses LDAP and Active Directory to authenticate users. There are 2 kinds of Users: Managers and Employees. They are differentiated by having membership in a particular AD group. In an ...
2
votes
2answers
295 views

Duplication of view access control logic in database queries and application component

Our web application has a complex access control system which incorporates role-based and object-level privileges. In the business logic layer, this is implemented by a component that obtains (and ...
3
votes
1answer
320 views

How to Implement Restricted Access to Application Features

I'm currently developing a web application, that provides some 'service' to the user. The user will have to select a 'plan' according to which she/he will be allowed to perform application specific ...
6
votes
1answer
949 views

What is the nicest (user-friendliest) way to tell a user about “Access Denied” error?

Our software implements a layer of role-based security to secure data access, in the form of access control lists. Whenever a user tries to do something that isn't allowed, the software layer will ...
2
votes
1answer
188 views

Should I manage authentication on my own if the alternative is very low in usability and I am already managing roles?

As a small in-house dev department, we only have experience with developing applications for our intranet. We use the existing Active Directory for user account management. It contains the accounts of ...
4
votes
2answers
605 views

What kind of permission is this? (Groups+Roles)

I'm starting to need an access control for roles in my app. I don't know much of this, but I understand how vBulletin works: I create groups, then give permissions to groups. I think that what I ...
4
votes
1answer
2k views

Methodologies for Managing Users and Access?

This is something I'm having a hard time getting my head around. I think I might be making it more complicated than it is. What I'm trying to do is develop a method to store users in a database with ...
5
votes
4answers
932 views

Why do organizations limit source code access to engineers? [closed]

Most organizations restrict access to the source code to engineers, and even at places like Google, the Android source code is kept off-limits to most engineers within the company. Why? Note: I am ...
2
votes
1answer
141 views

What is a good overview of options for access controls/permissions?

I'm in the process of designing the access control portion of a moderately complex application, but I feel like I'm re-discovering a lot of wheels. Does there exist a good overview of the "access ...
2
votes
2answers
233 views

Coding user rights

Imagine a system which has a number of functions and a number of users. A user must have rights to a specific function. Users may belong to a group. A group may belong to a group. So as a simple ...