CODEWITHSUNDEEP
mysqldatabase
Vidyadhar Mandke
Vidyadhar Mandke

Reputation: 588

How to define super user concept in MySQL DB for web application

I am developing the application in which i have a super user concept. Super user is the user who has all the access for the application. So what my initial thinking is in user table the user with id 1 will be my super user. but how safe is this in terms of security concern ? is there any other logic which i can use to define super user ?

I have done more emphasis in coding side. I also implemented the roles and other access permissions, But what i need to to do is something like ghost user. Whenever he logged in he could be able to access everything like he is a father of application. for his access i shouldn't need to check any role conditions or access condition. is it possible ?

Thanks.

Upvotes: 0

Views: 377

Answers (3)

Sylvain Leroux
Sylvain Leroux

Reputation: 52000

As a complement to the other answers:

Don't forget you could create users and grant/revoke permissions at DB level. I would not push for a 1-1 mapping between your application users and the DB users, but you could use that to implement "roles" and enforce permissions at DB level as an extra level of protection. This might be especially interesting if you have some users with "read-only" and/or "anonymous" access. This would prevent "escalation of privilege" due to a bug in you application code.

Super user is the user who has all the access for the application. So what my initial thinking is in user table the user with id 1 will be my super user.

In the Unix tradition, super-user is generally ID 0. This might improve code (maybe) and more important make it more understandable by programmers familiar with kernel/security coding.

But what i need to to do is something like ghost user [...] for his access i shouldn't need to check any role conditions or access condition. is it possible ?

I don't think this is a good idea to somehow "deactivate" all your security checks for one particular user. In order to improve maintainability and not clutter the code with permission-checking, as of myself, I would encapsulate all the code that need to check permissions in wrapper functions or objects, then I would use that wrapper in the rest of the application. Based on that, and if you implement "roles" at application level as someone else suggested, handling the "ghost user" shouldn't be too much of an issue.

Upvotes: 1

MikeD
MikeD

Reputation: 8941

From the database point of view it is valid to define two or more users and grant more or less permissions to them, work with roles etc.. But as you said - it's about the application. So in parallel to the database security you need to consider application security in terms of:

  • which user may get which functions, menu items, web pages etc.
  • how can this be configured and parameterized, etc.

I personally put a bit more emphasis on the application side and less on the DB side. So thinking of e.g. PHP + MySQL, I have 2 DB users (operator, admin), but a database table within my application for each (application) user, assigning to them the operator or admin login for the DB and defining which parts of the application they get.

Upvotes: 1

Sam
Sam

Reputation: 1366

Why not work with roles? Make a column in your user table where you have 'SuperUser', 'Admin', 'ReadOnly',... Or perhaps just 0, 1, 2... and match it with a constant/enumerable in your code. Now you can easily change your super user, make multiple super users, give someone temporary super user rights, define other roles...

Upvotes: 2

Related Questions