How to design Users, Roles and permission schema

databasepermissionsuser-roles

This is a very common thing in the web application developmet. I have done it number of times.

But I am stuck in my current project designing the schema for this.

The thing is my application will have three types of users in the begining e.g. SuperAdmin, Admin and the normal user.

I plan to have these user types as the roles like ROLE_SUPERADMIN, ROLE_ADMIN and ROLE_USER.

The system can have many roles. In fact SuperAdmin and Admins an create roles and assign those roles to users.

The problem is,

Super Admins will have permisson p1, p2 and p3.
Super Admins can create other super admins.
Super Admins can create admins.
Super Admins will not add users in the system.

Admins can have permissions p5,p6 and p7.
Admins can not create another admins.
Admins can create other users.
Admins can also create roles like say Report viewers.

Super admin with permission p1, p2 and p3 should be able to create Admins with permissions p5, p6 and p7. Which I am not quite getting.

Logically when Super admmins themselves do not have permission p5, p6 and p7, how can they create admins with these permissions?

Please help me out with the proper design with this.

Below is the design I have so far.

USER
UserID RoleID

ROLE
RoleID RoleName

PERMISSION
PermissionID PermissionName

ROLE_PERMISSION
RoleID PermissionID

Thanks.

Best Answer

This is a loaded question, setting up members, roles, etc. is no small feat. I suggest you take a look at already written libraries to see if they may suit your needs. What you should start googling for, is 'Access Control Lists' (acl) for short.