At work we are starting to consider a replacement for an old system. The new system will use the Spring framework.
The security model is pretty simple: it is open to the general public. Each one of our customers can identify himself by one of several methods (SMS to registered phone, private certificate,...) and access to/operate with his own data.
Due to the nature of the data, some data requires the user to be authenticated with safer methods (e.g. some pages cannot be accessed if the user authenticated by SMS, but can be accessed if the same user used a private certificate).
Now, we are thinking about which would be the right way to manage this. One obvious solution would be just mapping authentication levels to roles; the only downside I can foresee is that it could complicate things if, in the future, we need to define "actual" roles (e.g. an admin role).
So, in short:
- Am I using the correct terms for looking up information about this issue?
- Is there something flawed in just mapping the authentication method to a role?
- Is there any standard approach to this problem?