Reputation: 1186
Developing an access control for a Web Application, we have adopted RBAC. based on which each page and action is supposed to have an assigned permission to check its accessibility by the current user as a physical component, but this approach may lead to permissions conflicts when having a data level access, or for example when having a dynamically assigned privileges like Workflows.
For example, a tasks list page that anybody can access to see his own tasks will show nothing as long as the user does not have access to any task, in this case is it still recommended to restrict the access to the page itself based on roles? same concern applies to the task details pages themselves. If we added the RBAC restriction, then we will need to add a specific logic either by prioritizing data access regulations or by doing frequent changes to RBAC on runtime, which is an effort that doesn't worth it!
The question then is: Can we exempt specific pages from the physical access restriction as long as they are fully controlled by data access? or we have to leave both and deal with it!?
Upvotes: 1
Views: 33