Question

I’m going to implement an Access Control List for each individual user so they can assign access to their own resources so they can hide stuff, for example, from their mothers, but show their friends.

Now storing ACL in a database seems like it can get pretty insane when each user is also a group, which can have many sub groups. So I’m thinking of storing the ACL stuff in a text file.

Good Idea? Bad Idea?

EDIT: I should note, I’m talking about an individual text file for each user. I’m thinking of creating an ACL class which I could serialize and write to the text file. My fear is that storing the ACL in a database would create insanely huge join tables and put a significant strain on the database server.

Answer 1

Given the option I would store ACL in a database:

• The language to access and query the data is easier and standard (SQL)
• The DB will give you transactions, indexes for fast query, integrity constraints and security.
• Depending on how you store the data in a local file you may need to move your data files along with your application. Ex: Moving application from server1 to server2.
• For data that is immutable (or don’t change often) some form of cache should be used. So, independently if you’re using File or DB, you should be caching some of this data for some period of time.
• I’m pretty sure you can find good ACL schemas templates for relational database that you can use as a reference, like this document here: http://edhs1.gsfc.nasa.gov/waisdata/v2r20/ps/cd31110001.ps

I hope it helps.