How to manage a large number of permissions?

Question

I am working on a large Java EE web application with CRM functionality and we are looking for a security approach / library / solution / whatever. Basic role-based security will not work, since access control must be based on both a role and a hierarchy, but it does not have to be configured for each document. Since confidential and proprietary information will be stored, it is essential that security work properly.

Example: To use the store’s storage, offshore stalkers can create reports that other owners can read only in the same department. Now their department manager can read / write / update / delete all reports written by exchange companies and write reports. which all other department heads can read, but not see the reports of store managers, etc., With which district leaders can use r / w / u / d, etc. Now complications: people at higher levels can make things visible to people at lower levels, either for individuals (the department writes a document to several specific sellers), or for everyone below them (the store manager writes the note to the entire store) or any rearrangement, which you can imagine. In addition, individuals can create reports that their peers cannot see, or they can choose access to storage facilities for storing shares in other areas, etc.

We consider ACLs with one permission per entity, but worry about the large number of records created. Even if only the report was available to everyone in the department of 30 people and each person above them [in the command chain], ~ 40 entries would be required to create a single report! With 1 report per week per user, which has 2,000 permissions per user per year. 1,500 users - more than 3,000,000 permissions per year.

It seems that the rule-based approach will be enjoyable, but I have not seen any blogs or articles that mention this approach, so we do not dare to take this approach.

We also consider a hybrid home-brew ACL / rule, where you can grant permission to a department identifier with discriminator "manager" or "shareers", etc. for a subquery, but fear that checking all possible permissions (you may be given permission specifically by another user, you have permission as a member of your department, you may have permission as a member of a store or district) sounds like an error-prone tedious nightmare.

What is the best approach for our application?

Answer 1

You can see how to use Spring Security and ACLs - the good thing about implementing ACL Springs is implemented using AoP, which needs to be simplified for integration.

It looks like your security requirements are pretty complicated - I don't know how you implement this, but you can reduce the number of entries needed to create an ACL, against your hierarchy of objects and the presence of objects inherit 'from parent objects. You grant read permissions to the user of the parent Department of the report ) to inherit read access to child reports from this department. In addition, the manager may have read and update permissions for the Department. The key to all this is structuring your java object model.

I had a similar situation in a system where there were thousands of articles in the hierarchy of Business Unit - Publication - Issue - Article objects. You can have ACL hierarchies, so on my system there are users who had C / R / W permissions for a specific business unit, inherited permissions for all child objects in the hierarchy.

Answer 2

In my opinion, tuning + complexity = JBoss Drools, I do not have much experience using this technology, but I think it would be useful to look in your case, check the latest samples of drooling: http://blog.athico.com/2011/ 04 / try-drools-example-in-less-than-minute.html