<p>Does anyone know of some good resources related to setting up heirarchical user account systems? I'm currently setting one up and am struggling with some of the more complex logic (especially with determining permissions). I was hoping I might be able to find some resources to help me along.</p>

<p><strong>Some Background:</strong>
I'm building a user account system for a web CMS that allows for a nested group hierarchy. Each group can be allowed/denied access to read, write, add, and delete (either explicitly for that group, or implicitly by one of its parents). As if that weren't complicated enough, the system also allows for users to be members of multiple groups. -- This is where I'm stuck. I've got everything set up, but I'm struggling with the actual logic for determining pemissions for a  given user.</p>

[{'answer_id': 75490, 'author': 'Todd Gamblin', 'author_id': 9122, 'author_profile': 'https://Stackoverflow.com/users/9122', 'pm_score': 1, 'selected': False, 'text': '<p>Look at the permissions in the <a href="http://en.wikipedia.org/wiki/Andrew_File_System" rel="nofollow noreferrer">Andrew File System</a>.  It allows users to create and administer groups of their own, while selectively assigning admin rights and ACLs.  You might find that many of the pesky details are already worked out for you in their model.</p>\n\n<p><strong>Edit:</strong> here\'s a better link to AFS documentation:</p>\n\n<p><a href="http://www.cs.cmu.edu/~help/afs/index.html" rel="nofollow noreferrer">http://www.cs.cmu.edu/~help/afs/index.html</a></p>\n\n<p>Here\'s the section on groups:</p>\n\n<p><a href="http://www.cs.cmu.edu/~help/afs/afs_groups.html" rel="nofollow noreferrer">http://www.cs.cmu.edu/~help/afs/afs_groups.html</a></p>\n'}, {'answer_id': 75510, 'author': 'davethegr8', 'author_id': 12930, 'author_profile': 'https://Stackoverflow.com/users/12930', 'pm_score': 3, 'selected': True, 'text': '<p>The manual for CakePHP has an excellent description of how Access Control Lists work.</p>\n\n<p><a href="http://book.cakephp.org/2.0/en/core-libraries/components/access-control-lists.html" rel="nofollow noreferrer">http://book.cakephp.org/2.0/en/core-libraries/components/access-control-lists.html</a></p>\n'}, {'answer_id': 75571, 'author': 'Donn Felker', 'author_id': 5210, 'author_profile': 'https://Stackoverflow.com/users/5210', 'pm_score': 1, 'selected': False, 'text': '<p>I\'ve done exactly this before and its no trivial implementation. You\'re going to want to look at the SecurityPermission class. </p>\n\n<p>[<a href="http://msdn.microsoft.com/en-us/library/system.security.permissions.securitypermission.aspx][1]" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/system.security.permissions.securitypermission.aspx][1]</a></p>\n\n<p>I have done this before by utilizing XML (which I\'m not sure I\'d do again) and storing that XML as permission list inside of SQL server in an XML column through a CLR stored proc. The XML would have an element called a "permission" and then the permission would actually be a ENUM inside of the code. Each permission was a new implementation of the SecurityPermission class (linked above) Users were tied to groups which were defined in SQL server and then as the user was added/removed to groups, the XML doc would get updated to reflect which groups they were apart of. </p>\n\n<p>As soon as the user logged in, the users credentials would be loaded into the application store (session) and then would be accessed accordingly. When authorization needed to take place the XMl in the application store would be pulled down loaded into the SecurityPermission via the "FromXML" method. At that point I would use the following methods to determine if the user had permission: </p>\n\n<ul>\n<li>Demand</li>\n<li>Intersect</li>\n<li>Union</li>\n<li>IsUnrestricted</li>\n<li>IsSubSetOf</li>\n</ul>\n\n<p>etc., etc, etc. </p>\n\n<p>At that point after performing the Demand I was able to determine if the caller had access according to how I implemented my security routines in the SecurityPermissions. </p>\n\n<p>Again, this is leaving out a TON of detail, but this should get you going down the right path. </p>\n\n<p>Take a look at this name space as well: [2]: <a href="http://msdn.microsoft.com/en-us/library/system.security.permissions.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/system.security.permissions.aspx</a> "System.Security.Permissions"</p>\n'}, {'answer_id': 458047, 'author': 'Ben Aston', 'author_id': 38522, 'author_profile': 'https://Stackoverflow.com/users/38522', 'pm_score': 2, 'selected': False, 'text': "<p>Represent the permissions set for a given group as a bit mask. OR-ing the bit masks together will give you the resultant permission set.</p>\n\n<p>Update for @Alex:</p>\n\n<p>I wrote this answer 3 years ago, but I believe I was alluding to the following...</p>\n\n<p>From the question</p>\n\n<blockquote>\n  <p>a nested group hierarchy. Each group can be allowed/denied access to\n  read, write, add, and delete (either explicitly for that group, or\n  implicitly by one of its parents). As if that weren't complicated\n  enough, the system also allows for users to be members of multiple\n  groups. -- This is where I'm stuck. I've got everything set up, but\n  I'm struggling with the actual logic for determining pemissions for a\n  given user.</p>\n</blockquote>\n\n<p>Assign a bitmask matching the total permission set of a group (or role) in the system:</p>\n\n<p>e.g. <code>00</code> (using two bits keeps it simple here!)</p>\n\n<p>The first bit confers <code>Permission A</code> and the second <code>Permission B</code>.</p>\n\n<p>Now say Group A confers the following permission set: <code>01</code>.</p>\n\n<p>... and say Group B confers the following permission set: <code>10</code>.</p>\n\n<p>To get the resultant permission set for a user in an arbitrary set of groups you could perform a logical <code>OR</code> on the permission set bit masks:</p>\n\n<pre><code>Permission set for Group A   01\nPermission set for Group B   10 OR \n                             ----\nResultant permission set     11 (i.e. both permission A and B are conferred)\n</code></pre>\n\n<p>I do not know the details of the questioner's system, but the system outlined here could be augmented to achieve different group-composition behaviors using different logical operators.</p>\n"}]
['https://Stackoverflow.com/questions/75463', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/5291/']