Access Control List to manage Database Column that are fetched

Question

I have a site built in codeigniter for which I have designed an access control list to manage permissions of different types of users. Various users logged in to site are :

1. Super Admin
2. Admin
3. SEO User
4. Developer

Now I have completed the Access Control for this and permission for add, update, list and delete can be assigned to every user through a module accessible to Super Admin.

Now (this is a part of client's new requirement) I want to make the columns accessible to certain users, Eg:

If a table Products has 4 Columns

Products : 
id   |  Products | Price | Status
-----+-----------+-------+----------
1    |  prod1    | 20.0  |   1 
2    |  prod2    | 35.6  |   0

Now I want that for SEO Users Column Price does Not show up during the Listing.

NOTE : this is just an example, I need to make this dynamic so admin controls who has permission to which column. I cannot simply write If Else logic in my View File to exclude Unwanted columns.

Please Tell me how I can do this without redesign the whole system or making very major changes.

Muff

Answer 1

You can use ion_auth library .. very simple to integrate and manage users and access levels ...

Nilgai

Answer 2

That's why you use ACLs. ACLS are a dynamic way to store privileges. I hope you have a user model. In this model you need to read the ACLs for the current user. you set some constants for access level, similar to unix chmod. then you build an array with contains all columns and the acl value for this column.

To build your queries, you can use methods like

isSeo();

or

hasAccess($tableName);

Of course this is a major change but I don't know how you would like to implement ACLs whichout changing your code.

Enslave

I already have these functions to check user type privileges for any specific table.However what I am trying right now is I want to set user privileges on specific columns of that table. – Muff

Then i'd suggest to add a Parameter for the column: hasAccess($tableName, $column); – Enslave

Answer 3

May be try stored procedure/functions or try using raw SQL like this

GRANT SELECT(id,Products,Status) ON Products TO 'SEO User'@'somehost';

Penurious