implementing an ACL

Anon

Can someone give guidance on the relational design to implement a fairly simple ACL. Thinking hierarchicly (?), I have a web site with multiple 'sections' (directories, either physical or virtual via database), and subsections, and then documents. I want to be able to assign group level access to sections, and refine that access at the subsection and document level. So,

Root
Section1 -> Group 1 Only
--> SubSection1
--> SubSection2 -> Group 1 Managers
-------> Doc1
-------> Doc2-> Joe only
Section2 Group 2 Only

I'm trying to derive the best data model for this. Users can be in more than one group, and subsections and documents should inherent security, but they can be overridden by assigning more restrictive access to a user or a group.

Lot's of the open source php apps seem to have complex ACL functionality, I just can't figure out where to start to set one up. Do I assign each "object" i.e. a folder/section or a document to a list of those that can have access, so a one to many relationship ? Do I need permission levels, such as read, edit, delete ?

Any guidance is appreciated.

Thanks,
Brian

Anon

Hello

I have tried to implement something like this before. It based partially on the access system used for phplib. What I did is use binary numbers. So lets say you have 5 sections in a website then the binary number is 5 digits. Each one section will correspond to one section

00001 --> section one
00010 --> Section 2

etc, Then you assign binary access values to each user, for example a person who has access to both section 1 and 2 will have a value 00011. Then when he logs into the page stick in a function at the befinning which will do an AND operation for the page i.e (For section 1) 00001 AND 00011 and see if you get back the initial value which is 00001. If you do , the dude has access , if not he doesnt.

Stick in a few sql tables, etc, and you have yourself a multilayer access system. Although its not that hierarchical. Tell me what you think.

Mohan

Anon

I'm looking into this, too. (I know you originally posted this last February, BTW).

I know of some GPL implementations of what you/I want, but using them outside of their normal apps might be difficult and coupld be illegal, if not messy.

<opinion>
PHPGroupware (semi capable/mature ACL's). http://phpgroupware.org/ (Two strikes against them, though. Sloppy/slow/fragile code and very, very, very poor/out-of-date documentation). Good eye candy, lots of integrated apps, an extreme level of interest and momentum, though. Some day it'll be best in all areas, perhaps. It's hard to use the API outside of PHPGroupWare, though, and it changes daily. :-(

TUTOS (news to me tonight, I didn't realize they had an ACL, good docs, better code than above). http://www.tutos.org/

Horde Framework, maybe? (It's very mature/documented, too). http://horde.org/horde/

TWIG is doing it, too, I think, but hmmmm: http://twig.screwdriver.net/index.php3

PHProjekt (Ummm, well....): http://www.phprojekt.com/index.php

Eutychus may get there some day, maybe not, but it's worth a look: http://www.xmlhead.com/index.php/xmlhead_eutychus

The Prometheus API is moving that way: http://prometheus.sourceforge.net/

I don't know about PEAR, now or in the future: http://pear.php.net/

Binary Cloud doesn't seem to, yet their stuff is well-documented. http://www.binarycloud.com/

There needs to be a better, more capable authentication/sessions/permissions/acl API for PHP, one that is either under the LGPL or BSD, or that is under the GPL and makes it easy to extend their classes to fit your own use, yet can keep some coders out of legal hot water....

PHPLib isn't what I'm looking for, for ACL or permissions. It is, however, what I'm looking for, for authentication and sessionization. I am trying to extend it to PHPGW's ACL database schema, and it ain't all that easy, because of PHPGW.... 31 permissions bit fields and no ACL. It's pretty fast and used everywhere. Medium quality documentation.

Have you found out anything? I'm using PHPGW as a model, but unfortunately their code is convoluted.

The above represents my exhaustive search. I need something really good, really fast, myself.
</opinion>

Anon

Oh, and there are LDAP, OS, and web server ACL's, too. LDAP might be a really good fit, if it can be implemented in your situation....

tanis

I'm trying to do something similar, too.
But it gets damn hard to implement an ACL solution like the one I've got in mind.

It needs to be a users/groups model with hierarchy. But I also want to be able to stick all the checks to every PHP function.
This way I should be able to activate/deactivate functions based on the current user's permission.

But it's getting really hard.

Anon

Thanks for the ideas, I came up with a fairly crude system that works with my own session class ( I created it before php session and before I had heard of phplib, so I still use it). It is sort of user/group based, but it is more "functionality based", for lack of a better term. I have assigned a name to each major piece of functionality in my app, such as AddUser, EditUser, etc. The sys admin can assign a group a list of these functions, which are inherited by the group's users. I have a session method similar to phplib's openpage that can check for the presence of a required permission, and I also use the session object throughout scripts to check for permissions. I do this to build menus. So, if a group doesn't have EditUser permission, they don't see this menu option.

It is far from elegant, but it works, so I use it.

Brian