Manage roles and permission per data segmantation

Hello, I am currently designing the roles and permission in my website. I encounter a issue that I couldn't find a clean solution for. Assuming my web site has database when all data are segmented by organizations. for example, I have an organizations table, and all other tables in the database must have an organization_id. Now, in addition to "super admin" role which admin for all organizations, I need an "organization admin" role for a specific organization, because I have for each organization an administrator that manage all data related to this organization only, but when assign this "organization admin" role to a user I cannot define for which organization this role is relevant. I am ending up creating roles for "organization 1 admin", "organization 2 admin" and such on. But I am looking for more clean solution, such as $user->assignRole("organization admin",$specific_organization); Take also in mind that one user might be organization admin for several organizations such as: $user->assignRole("organization admin",[$specific_organization1,$specific_organization2]);

I was also thought about another solution, still not clean because it is customized "extension". I can manage a new table called "organization_user_role" with:

organization_id
user_id
role_id

But then I cannot use $user->hasRole() of the package laravel-permission, so I need to manage two permission systems, which I don't prefer. I am looking for a solution to use the same permission system to achieve the goal I asked above.

I will really appreciate a clean solution. Best Regards, Avi

jlrdw

6 years ago

Level 75

Prefix your roles or even suffix, like admin01 for organization 1, etc.

But also search and study multi tenant applications as well.

I myself do use laravel authentication, but use custom authorization that works with it to basically say:

Does this method that requires a role of bookkeeper match one of the roles of the logged in user.

If yes allow, if no redirect. My custom stuff is more like spatie.

Good luck, because normal RBAC is tricky enough to setup, multi organization, well have plenty of asprin on hand.

And I highly suggest you plan this with pencil and paper as you go, will make it easier.

avictory

6 years ago

Level 1

Hi jlrdw, Thanks for your fast answer. I am actually using what you suggest having "admin01" role an such on. I see that there is no out of the box solution, so I better design my own solution.

Thanks again,

Best Regards, Avi

Please or to participate in this conversation.