Implementing ACL for my PHP application

Question

My RealEstate PHP Application have following user groups,

Admins, Moderators Agents

i want to specify following permission to the following users.

Admins - >

• Can Create Moderators,
• Can Create Agents,
• Can Insert Properties,
• Can Update Properties,
• Can Delete Properties

Hence an Admin will have all the privileges in short an Admin here will be superAdmin

I want to assign limited privileges to the moderator and hence to the agents.

i am confused on how to Create a Database for this and also on how to implement it in my PHP Application.

thank you

Answer 1

It sounds like you are going to need a role-based access control system. Developing one is not really a trivial task, so as already suggested, finding a framework or ready-made class that does the job would be a worth while start.

Role Based Access Control

http://www.tonymarston.net/php-mysql/role-based-access-control.html

http://www.sqlrecipes.com/database_design/fine_grained_role_based_access_control_rbac_system-3/

http://www.sitepoint.com/forums/showthread.php?threadid=162027

You should create a table wher you have to define all type of role.

and one table for users

relate different roles to different user Via linking two tables. and some thing like this ......

Answer 2

The way that I have done this in the past was to create a users table in the database that had an access level (Admin, Moderator, and agents).

Then if you have a menu system, implement a check to see what privileges are needed for what links... Admins will see all links, Moderator will only see links he/she is supposed to, and agents will only see what they are supposed to see.

Also on the pages that you may want to restrict users you will want to check for the users access level. If they pass, they will see the page, if not, they will be redirected or a javascript error will need to pop up.

Something like the access level may do you some good to store it in a cookie as you can cut down your calls to your database.

Hope this helps, Mike