title: How to implement a group & role based permission system?
body: <p>I am currently building an application in PHP using the Symphony 2 library, but I guess this question is applicable to any sort of web application. Here is the basic infrastructure I would like to implement:</p>
  <ul>
  <li>every user is part of one or multiple groups</li>
  <li>every group implements one or more roles</li>
  <li>roles implemented by a group apply to all users in that group</li>
  <li>a user can implement additional roles not in its group</li>
  </ul>
  <p>An example</p>
  <ul>
  <li>a group 'writers' implement the 'writer' role and the 'comment moderator' role</li>
  <li>an group 'administrators' implements the 'admin' role</li>
  <li>a user 'Henry' is part of the writer group, and the administrator group</li>
  <li>a user 'Henry' implements the 'owner' role</li>
  </ul>
  <p>The roles affective for that user would be 'writer', 'comment moderator', 'administrator' and 'owner'.</p>
  <h1>Edit</h1>
  <p>Is it a good practice or not to have this behavior : user can inherit roles from its own group and can have individual roles as well.
  And if so, how to make it real ?</p>
  <p>I thought of 5 tables :</p>
  <p><strong>Users</strong> :</p>
  <ul>
  <li>id</li>
  <li>name</li>
  </ul>
  <p><strong>Role</strong> :</p>
  <ul>
  <li>id</li>
  <li>name</li>
  </ul>
  <p><strong>UserRole</strong> :</p>
  <ul>
  <li>id_user (FK)</li>
  <li>id_role (FK)</li>
  </ul>
  <p><strong>Group</strong> :</p>
  <ul>
  <li>id</li>
  <li>name</li>
  </ul>
  <p><strong>GroupRole</strong> :</p>
  <ul>
  <li>id_group (FK)</li>
  <li>id_role (FK)</li>
  </ul>
  <p><strong>UserGroup</strong> :</p>
  <ul>
  <li>id_user (FK)</li>
  <li>id_group (FK)</li>
  </ul>
  <p>This could work and the main problem would be to prevent adding an individual role a user already has from the groups it belongs to.</p>
  <p>Be it seems to be a little complicated. Is there any better way to do so ?</p>
  <p>Thanks</p>