Implementing ACL for my PHP application

Question

My RealEstate PHP Application have following user groups,

Admins, Moderators Agents

i want to specify following permission to the following users.

Admins - >

• Can Create Moderators,
• Can Create Agents,
• Can Insert Properties,
• Can Update Properties,
• Can Delete Properties

Hence an Admin will have all the privileges in short an Admin here will be superAdmin

I want to assign limited privileges to the moderator and hence to the agents.

i am confused on how to Create a Database for this and also on how to implement it in my PHP Application.

thank you

Linin

Answer 1

It sounds like you are going to need a role-based access control system. Developing one is not really a trivial task, so as already suggested, finding a framework or ready-made class that does the job would be a worth while start.

Role Based Access Control

http://www.tonymarston.net/php-mysql/role-based-access-control.html

http://www.sqlrecipes.com/database_design/fine_grained_role_based_access_control_rbac_system-3/

http://www.sitepoint.com/forums/showthread.php?threadid=162027

You should create a table wher you have to define all type of role.

and one table for users

relate different roles to different user Via linking two tables. and some thing like this ......

Frisco

Use framework like cakephp or zend. they have inbuilt components libraries for ACL and also easy to learn – Frisco

Answer 2

The way that I have done this in the past was to create a users table in the database that had an access level (Admin, Moderator, and agents).

Then if you have a menu system, implement a check to see what privileges are needed for what links... Admins will see all links, Moderator will only see links he/she is supposed to, and agents will only see what they are supposed to see.

Also on the pages that you may want to restrict users you will want to check for the users access level. If they pass, they will see the page, if not, they will be redirected or a javascript error will need to pop up.

Something like the access level may do you some good to store it in a cookie as you can cut down your calls to your database.

Hope this helps, Mike

Synectics

...you mean a cookie, which they could arbitrary modify to increase their access level? – Lobel

True Cookies are a little insecure however you could just verify then by checking the database. Most of the apps that I had to build were for internal employees and there wasn't really anything to gain other than to see other pages. Not to mention everything was logged so even if you bypassed some checks it would log your page hit. I'm glad it helped. I hope to continue to help out on this forum. – Synectics

You could sign the cookie before issuing it, to ensure integrity. – Zobkiw