1

I have to write a node module for handling role-based access control. Users are stored in database, there are user groups, and there are system assets or functionality that users and groups can be given or denied access to.

I am considering the most appropriate terminology for these concepts:

  • system asset/functionality = "right"?
  • that a user is allowed to access certain asset/functionality = "permission"?
  • We cannot help you with this because there is no objective criteria here; its up to you. I have seen all three terms used in access control code. I use permission because right is something that you are entitled to instead of being granted and privilege is luxury; Think of it from the point-of-view of a moderator or adminstrator: they have to take adminstrative action. They are granted the permissions so that they can do their job - thats the only reason. And to me that is neither a right nor a privilege. – marstato Sep 30 '17 at 10:47
  • 1
    Are you aware that RBAC has defined terms? en.wikipedia.org/wiki/Role-based_access_control – schroeder Sep 30 '17 at 11:15
  • 2
    You should not implement authorization yourself. There are many modules that implement rbac and ABAC out of the box. It'll save you time and you won't make implementation mistakes. Look into what NIST has to say on RBAC and ABAC. – David Brossard Sep 30 '17 at 23:54
3

Role Based Access Control is a well defined model, that comes with its own terminology. At minimum, RBAC has the following entities:

A User has one or more Roles.
A Role is a collection of Permissions.

A Permission (or privilege) is the right to perform an Operation (or action) on a Resource (or object).

So, from what you describe in your question, I would say that

  1. your model is not complete yet (operation is missing);
  2. your 'system asset/functionality' is a resource;
  3. "that a user is allowed to access certain asset/functionality" is indeed a Permission

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.