0
votes
1answer
21 views

ACL managed with roles

I have resources in an application. Further I have a table holding all resources and for every resource what role is allowed to access it. I also have defined a Table holding all uses that are ...
1
vote
1answer
431 views

What is the difference between claims, attributes, and roles?

Many questions have already been asked about Claims-based authentication and the differences with other approaches: Role-based vs Claims-based Explain claims-based authentication Now, my favorite ...
2
votes
2answers
99 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if ...
6
votes
1answer
287 views

What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?

In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
8
votes
2answers
2k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
4
votes
4answers
165 views

How can an Subject only read and write to its owned objects?

It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
10
votes
4answers
2k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership? For example: Bob is a doctor and has the role ...
9
votes
4answers
828 views

RBAC model: user in two roles access dilemma

I am implementing the Role-Based Access Control (RBAC) model security system and I have a dilemma: one User1 is in Role1 and is in Role2. Role1 allows access to the Resource1 and Role2 denies access ...
21
votes
1answer
12k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...