Question

We have a web application where we need to create functionality to manage users, roles , modules and their permissions.

Below is the design we have created. can anyone Let me know if it is proper way of implementing such functionality?

User table will have two columns as follows

1) Id
2) Name

Role table will have Role Id and role name.

A user can have multiple roles hence, we will have a user role reference table which will have user id and role id.

Role can be Admin, User, Moderator etc.

There can be lots of modules like Country , States, Orders, Divisions etc.

Each role will have access to certain modules like Admin will have access to all modules.

User will have access to few modules like Order only and so on.

So for this we have a separate static Modules table which will have module id and name.

We will have another Role Module reference table which will hold the information of which role have access to which modules.

Again, each user will have some roles and thus will have access to certain modules.

Now access to this modules is also based on permissions.

Like User will have only read permissions on States and Country i.e. he can only view the details.

Admin will have write permissions on states and country so that he can add, edit and delete them.

So, how do i go about implementing/designing this whole functionality in java?

Answer 1

Tables:

• User (userID PK, name, etc…)
• Role (roleID PK, name UQ, etc…)
• UserRole (userID, roleID, PK(userID, roleID) dategranted etc…)
• Module (moduleID PK, name UQ, etc…)
• RoleModuleAccess (roleID, moduleID, PK(roleID, moduleID), accessFlags)

To find out the access a user @userID has in a module @moduleID:

select accessFlags
from RoleModuleAccess rma 
    inner join UserRole ur on ur.roleID = rma.roleID
where rma.moduleID = @moduleID and ur.userID = @userID