Best practice for implementing permissions in a system?

Question

I have an application that contains various kinds of permissions. As mentioned in the RBC Base Security section, I grouped users into roles and assigned different permissions for the roles. (and permissions in this style:

public enum Permission { View = 1, Create =2, Edit =4, Delete =8, Print = 16 } 

everything is fine in simple systems, but when the system becomes a little complicated, certain permissions enter the system, such as:

• Show Only His Issued Invoices
• View all invoices
• Change Only His Issued Bills
• Change all invoices
• Create invoice
• Create a purchase invoice
• Create Proforma
• Create a sales report on your accounts
• Create daily sales report
• Create a monthly sales report -....

As you can see, different types of permissions appear in the system (it can grow up to 200 different permissions). So the problems are:

• I cannot put them all in one enum . then using a binary pattern (1,2,4,8, ...) cannot be used, since in the best case (int64) it supports up to 64 different resolutions.
• a large enumeration (about 200 elements) does not code so well

What are your ideas in this case?

in advance :-)

Answer 1

I am not sure why you feel that you need to try to transfer all permissions into one checkbox (or so I deduce from vales) the listing. Permission requests and grants can be submitted using lists, rather than a single ORed value. If you use a list approach, you can freely create any permissions that you like. For example, you can use enumeration of non-flags or even several enumerations to represent your rights.

Answer 2

Sounds like you need a level of indirection ...

For example, you need a category (represented by an object, say) that represents "His issued invoices." You need a way to grant a role to any of your basic permissions on this object. You need a way to check if something is a member of this category.

Suppose that Jane is trying to view an invoice. Then you just need to check: does Jane have a role that has the form of access to any category of which this account is a member?

This check can be slow, since you need to check all the roles of Jane against all categories of accounts. But presumably you can cache the result ... Or you can use the “based” approach, where Jane asks the security manager for the descriptor (pointer) for the invoice with View access. The security manager performs the check and passes the handle to Jane, after which she can use this handle to perform the browsing operations supported by the handle without additional security checks.

Answer 3

I agree with Nicole, it looks like you are doing what might seem like a good optimization, but you are facing scale issues.

Many RBC systems deal with a large number of permissions, which is one of the reasons why roles exist - ordinary users only need to know what role they are in - to leave developers the ability to display the display of access rights. Large systems can provide a graphical interface for superusers to perform authority mapping and even create permissions, but only to provide maximum user flexibility.

However, because of J2EE, at the code level it all comes down to checking for "roles" programmatically. This tends to confuse things when what you really want to check out is permission to perform the operation. Just keep that semantic space.

In terms of optimization, consider not the method of assigning permissions, but when and how you perform the check. In a web application, you may only need to check when a call comes from the external interface, and perhaps network latency will overshadow any optimizations you perform here.

If you decide that you want to optimize, you will probably find simply caching permissions at the login. The actual resolution search will be stored in memory, so it will be tiny after initial loading from the database.

To avoid a combinatorial explosion of permissions, set a strong logic in front of you - write it down - and make sure that you cover all your bases. If you see the need to create new dynamic permissions, for example, when new entities are added to your system, then pay attention: this is better done in the template of an intermediary or manager who can check your business rules before handing out protected organizations. Here you go into the field of libraries, such as Drools, which serve to expose the business logic from your application so that it can be updated based on changing business requirements.