I am designing a security model for a web application which restricts access to certain parts of the app depending on what rights and permissions the user has. These rights and permissions are grouped together into Roles that each user can be assigned to.
However I need to create an System Administrator role that gives a special user full access to everything. In order to tackle this I can go about it in two ways:
- Create a Role of System Administrator and give it every single permission/right in the system (basically all the rights are stored in a DB table). As the application evolves and becomes larger, the Administrator role must also be updated so that it has access to the new stuff.
- Within the application itself, I allow for the System Administrator role to bypass security restrictions. So essentially it will check if the user has a certain permission, or if they're a System Administrator, it will let them through.
Option 1 presents some problems: it could be tedious and prone to oversight because each area of the application has Create, Read, Update, Write, and many more permissions. I have to include every possible combination of application area to permissions in a table for the role to have full access.
Option 2 present its own problems: the System Administrator bypass is hard-coded into every single area where a restriction is needed. If the name of the System Administrator role was to change (e.g. Master User) then I'd have to update the code everywhere. However this option means I don't need to worry about constantly updating the Role table so that the System Administrator gets permission to access new stuff.
I'm building an enterprise class software so it has to be scalable whichever option I go with.
Yes I know this is highly subjective if just treated just as is. But I believe there must be some good-practice security design pattern where one way is recommended over the other. There are things I can't foresee right now which others may have encountered. I would even appreciate some links to thoughts on this and good way to go forward.