I work on a REST API that mixes two types of security:
First you have standard role-based security – so we have multiple roles such as administrator, read-only user, super user user, etc.
Then we also have most of those users belonging to certain customers, so we need to secure specific resources (and child resources) based on user customer / owner.
Is there a well-accepted name for this second type of security? The reason I am asking is that I want to find what patterns exist out there to working with the mix of the two – and it is hard to search for it if you do not know proper term for it.
-
If an owner can grant access to other users, then it is called Discretionary Access Control (DAC):
discretionary access control (DAC) is a type of access control defined <…> “as a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. <…> The term DAC is commonly used in contexts that assume that every object has an owner that controls the permissions to access the object
This is a model used in unix-like OSs, where each file/directory has rights for owner, group and other users – see chmod.
-
Otherwise, if an owner just has a fixed set of permissions assigned by someone else (administrator), then I think it’s just an ACL-based model, where subject is not a concrete user, but just an abstract “owner”. You can think of it as an access rule where subject (user) is checked by a condition which is not like
user.name == 'Alice', but likeuser == object.owner. That way, it’s just an ACL with custom “matching” rules.
I might be wrong here, so please check the list of access control models.
1