Applying Linux Group Ideology to Web Applications -

i have built database driven web application has user , group system works in similiar way linux handles user access.

breif explanation:

a user can access various resources, resources assigned single group , users can have many groups.

users

 id   name   --   -------   1    redranger  2    greenranger 3    blueranger

group assignment

 user group ---- ----- 1       33 1    44 1    55 2    33 2    44 3    33 3    44 3    55 3    66

group description

 gid name   --- ----   33  user   44  things   55  stuff   66  foo

resource

 name group ---- -----    33 b    33 c    33 x    44   y    55 z    66

redranger can access a, b, c, x , y not z
greenranger can access a, b, c , x
blueranger can access a, b, c, x, y , z

lets redranger needs denied access resource a

if remove him group 33 can no longer access b or c no good.

the alternative change a's group , add else new group, isn't bad 3 users, 3,000?

if situation occurs there mess of groups.

what best approach problem?

a resource should able "belong" more 1 group, rather one. limitation restricts design.

you're part way towards rbac system; have read on , see how little bit more flexible better result.

shell