Permission system with RBAC and ACL mixed (II.)--RBAC-based system permissions

http://fightplane.iteye.com/blog/1278464

1. Concept note

A System-level permissions : From a role perspective, the permissions are not specific to any actual resource. such as "whether the user can modify the title" This permission, not for any particular title. Permissions are given to a particular role. Using RBAC model to realize

B Object-level permissions : from the object instance's perspective. For example, for a particular title, edit the permissions on the title. Implemented with ACL model.

Then determine whether the user can modify the title of a bar to determine the following order:
1) Whether the role that the user belongs to has the "Modify title" permission
2) Whether the user or user group is in the ACL list of a header

2. Table structure description for RBAC permissions section

1) system permissions (Permission)

System Permissions List

Name	Defined	Description
Id	bigint	Primary key, System permission ID
Name	varchar	Name

2) roles (role)

Role table

Name	Defined	Description
Id	bigint	Primary key, role ID
Name	varchar	Name

3) Authorization (authorities)

Grant multiple system-level permissions to a role

Name	Defined	Description
Id	bigint	Primary key, ID
Roleid	bigint	Role ID
PermissionID	bigint	Permission ID

4) User group members (memeberships)

User groups and members of user groups

name	definition	Description
ID	bigint	primary key, user ID
GroupID	bigint	User Group ID
UserID	bigint	user ID
r Oleid	bigint	role ID

3. Description of the relationship in the RBAC permissions section

Users and Roles: Users and roles are many-to-many relationships. However, when a user is granted a role, the user group is the unit. For example, user A may be the "administrator" role in user Group 1, but in user Group 2 it may be a "normal user" role. This division is more common in business systems. Of course, specific to a user, the role of which user group to make judgments, is determined by the business.

roles and system-level permissions : is a one-to-many relationship. To be done by authorization. Of course, before authorization, you need to inject the necessary system and permissions into the database permission table.

Permission system with RBAC and ACL mixed (II.)--RBAC-based system permissions