I want to implement an RBAC, Flat based. I've decided to base my system on the NIST standardization model.
Although all fine and well, I have an inclusion to that design.
Instead of a hierarchy for roles, I have a hierarchy at the permissions side: each permission will be related to a "module".
I'll explain with a diagram:
User U1 -> R1 & R2. Role R1 -> P1, P2. Permission P1, P2 -> Module M1.
- A user can have multiple roles.
- Multiple roles can be assigned to a single permission.
- A permission can only be assigned to a single module.
What I have in my head in terms of a schema to hold this data, is as follows:
ac_users user_Id userRole_Ref ac_user_roles role_Ref user_Ref ac_roles role_Id role_Title ac_modules mod_Id mod_Title modPerm_Ref ac_permisions perm_Id perm_Title ac_permision_roles pr_Id pr_Role prPerm_Ref
I'm worried this will cause to much overhead for this particular design.
The basic concept is that all tables will need to have a many-to-many relationship, except for
ac_permissions which will have a many-to-one relationship with
Could anyone point out flaws with this design?