1

I have resources in an application. Further I have a table holding all resources and for every resource what role is allowed to access it. I also have defined a Table holding all uses that are registered to my system and the roles they are allowed to play.

My question now: Is this an ACL managed with roles (that could be also called groups)? Or is this a flat (core) Role Based Access Control? I do not really see the difference between these two.

Thanks.

|improve this question
1

Does it matter?

It is both or it is the one that make sense. Probably one makes sense in one context and the other in another.

My background is in Enterprise Directories so I would talk about RBAC and I think that this is more understandable to the business. But ACL's are more understandable to infrastructure techies.

So who is your audience?

Also, where are you going with the application? What is it's future. Will it get more capabilities? It is easier I think to talk about RBAC as you create more layers such as location based control.

|improve this answer
  • My audience are developers of devices that connect them to the Internet. I am building an access control framework that is integrated with a communication stack. The developers will need to define an ACL for each resource stored on their device containing all roles that are allowed to access it. – user49312 Jun 14 '14 at 19:21
  • I would say that, if the requirements will never get more complex, you might be better sticking with the ACL terminology. However, if the requirements may ever need to expand, the RBAC terminology is more flexible. – Julian Knight Jun 15 '14 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.