Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I want to implement an RBAC, Flat based. I've decided to base my system on the NIST standardization model.

Although all fine and well, I have an inclusion to that design.

Instead of a hierarchy for roles, I have a hierarchy at the permissions side: each permission will be related to a "module".

I'll explain with a diagram:

User U1 -> R1 & R2.
Role R1 -> P1, P2.
Permission P1, P2 -> Module M1.
  1. A user can have multiple roles.
  2. Multiple roles can be assigned to a single permission.
  3. A permission can only be assigned to a single module.

What I have in my head in terms of a schema to hold this data, is as follows:

ac_users
     user_Id
     userRole_Ref

ac_user_roles
      role_Ref
      user_Ref

ac_roles
      role_Id
      role_Title

ac_modules
      mod_Id
      mod_Title
      modPerm_Ref

ac_permisions
      perm_Id
      perm_Title

ac_permision_roles
      pr_Id
      pr_Role
      prPerm_Ref

I'm worried this will cause to much overhead for this particular design.

The basic concept is that all tables will need to have a many-to-many relationship, except for ac_permissions which will have a many-to-one relationship with ac_modules.

Could anyone point out flaws with this design?

share|improve this question
    
How do you define a module? Where is the "operation" equivalent in BARC? –  Emmad Kareem Sep 25 '12 at 3:31
    
Why not use your database's built-in users and roles? –  Neil McGuigan Nov 15 '13 at 18:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.