Permissions Model |
One of the critical elements of Ganymede's design is the permissions model. Ganymede needs a universal permissions model that allows complete flexibility in apportioning privileges to classes of users/adminstrators, without becoming so unwieldy as to be impractical.
The solution is a 2 level object model, where individual Users are associated with multiple Admin Personae. Upon logging into Ganymede, a user will be able to select which Persona he or she wishes to work as, with an 'su'-like facility for switching Personae. Each of these Admin Persona may be a member of multiple Owner Groups. All objects are owned by these owner groups, which allows adminstrators to be granted privileges to a wide range of objects without having to have someone go through all the objects in the Ganymede database and change the owner list. An invidual object in the Ganymede database may be owned by multiple owner groups.
The Admin Persona object is associated with a Ganymede login, confers membership in a variable number of Owner Groups, and has an associated list of Role objects. Each Role object contains two Permissions Matrices: one for objects owned, and one for default persmissions. These permission matrices contain an array of booleans which allow access to the database by object type and field, with create, edit, view, and delete permissions categories. These permissions bits are combined together across all of an Admin Persona's permission matrices, and filters the admin Persona's permissions when accessing any object in the Ganymede database. A large set of Admin Personae may be configured with the same Permissions Matrix object, allowing for central permissions administration.
The combination of the Owner Groups, which determine which objects are accessible, and the Roles, which determine what can be done to those objects, provides complete flexibility while maintaining the ability to make wide-ranging changes in the authorization schema by the simple editing of one or two objects in the Ganymede database.
Although it is not shown explicitly in the below diagram, all of the objects shown are themselves owned by Owner Groups, so the system is self-administering. The same permissions system that controls access to the Ganymede database also controls access to the controls themselves. There is a special owner group, called 'supergash', in the system. All Admin Personae that are members of this owner group have full privileges in the system, and can bootstrap this authorization schema.
As powerful as this system is, it is not complete. There will be cases where a more specialized permissions model is required. Take for instance the case of maintaining a public mailing list that users should be able to add and remove themselves, but not touch any other user in the list. This can be accomplished through the authoring of custom plug-in classes which can provide any level of intelligence needed to objects of a given type.