0

I have been reading about ACL and it is quite interesting but I am not sure if ACL is a right tool for my new backend system.

I want to restrict certain features from User Groups and Roles, for example:

  • "Processing" group can see a category dropdown but it will be hidden from a "Sale" team.

  • "Processing" group a see a few options in a category dropdown. Admin group can see everything.

  • If I add a new group called "Training" - I would like a "Training" team to have access to a category dropdown.

Is ACL right tool for this? If so - how can it be done.

user1246800
  • 287
  • 1
  • 3
  • 13

2 Answers2

0

Access control list - list of permissions attached to an object. It specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects. - wiki

So it fits exactly to your problem.

Create actions, users and then just set actions for the users. Or create groups and set the actions for the group and then put the users to specific group.

tttpapi
  • 838
  • 2
  • 8
  • 28
0

ACL - access control lists - is a good starting point but you probably want to look at more advanced authorization models for instance role-based access control and later attribute-based acccess control. NIST has defined these two models extremely well:

RBAC and ABAC will scale better than just ACLs.

David Brossard
  • 12,223
  • 6
  • 42
  • 72