title: Normalizing Foreign Keys with Junction & Lookup Tables
body: <p>I've been scratching my head lately over the relationship between database normalization and foreign keys with respect to junction tables and lookup tables.</p>
  
  <p>I’ve currently have the following tables: Users, UserTypes, Roles, UsersInRoles, and Permissions. UserTypes is simply a lookup table providing the name of the type, with description, via a foreign key in the Users table. Roles are the various roles with associated Permissions linked to each User via the UsersInRoles table.</p>
  
  <p><strong>I need to come up with a structure that allows me to</strong> provide multiple Roles for each User, in addition to special permissions for each respective User that may not be covered in the fixed Roles of which they are a member.</p>
  
  <p>I had a foreign key to my UsersInRoles table from the Users table, but decided that it just didn’t make sense. Conversely, it seems to make perfect sense to use a foreign key from the Users table to the UserTypes table. Is this the rule of thumb? That junction tables have foreign keys linking to the primary keys of the tables it joins, while master tables have foreign keys linking to the primary key of associated lookup tables?</p>
  
  <p><strong>Parameters:</strong></p>
  
  <ul>
  <li>Each User can have one or multiple Roles</li>
  <li>Each Role has a fixed set of Permissions</li>
  <li>Each User can have additional Permissions not provided by their Roles</li>
  </ul>
  
  <p>I suspect I may also need a PermissionsInRoles junction table as well as one for PermissionsInUsers? But this is just ridiculous isn't it? There just must be a better way. I'm thoroughly convinced that I'm losing my mind here, lol. Any help would be greatly appreciated. This has got my head spinning :P</p>
  
  <p><strong>UPDATE</strong><br />
  Is this basically how it would be setup? I might get rid of the UsersInRoles table so each user can only be in one role, and additional permissions can be added via the SpecialPermissions junction table. From a UI standpoint, I was thinking it might be good when assigning permissions to a user, selecting a "Role" would simply check the appropriate boxes associated with that role, then you customize that and submit. That way I think I would only need a junction table between the Users and Permissions tables perhaps? Ugh. This is quite daunting for a first time database designer haha. Remember when you were just starting out? Or maybe you guys are more of a genius than I am, lol.</p>
  
  <p><a href="http://img339.imageshack.us/img339/4752/basicsecurityschema.png" rel="nofollow noreferrer">Schema Image link</a> (can't post images yet)</p>
  
  <p>Here's a neat scholarly article (albeit 10 years old) on query-driven database design titled: "<a href="http://www.misrc.umn.edu/workingpapers/fullPapers/2001/0119_090101.pdf" rel="nofollow noreferrer">Robust Database Design for Diverse Query Patterns</a>". The Conclusion section has an interesting approach.</p>