Framework solution
The implementation of access control falls into three classes. One is the class that is asked questions about who can do what. Closely associated with this is another class that caches general information applicable to all users. It is made a separate class to aid implementation of the split of cache between generalD and user specific. The third class handles administration operations. Before looking at the classes, though, let's figure out the database design.
Database for RBAC
All that is required to implement basic RBAC is two tables. A third table is required to extend to a hierarchical model. An optional extra table can be implemented to hold role properties. Thinking back to the design considerations, the first need is for a way to record the operations that can be done on the subjects, in other words to record the permissions. They are the targets for our access control system. You'll recall that a permission consists of an action and a subject, where a subject is...
