Role Templates, Roles and Users

In this section I will explain the concepts of roles, role templates and also discuss how roles are associated with users.

Suppose we have three type of clients in our bank: student, standard and VIP.  Each manager only works with clients of a certain type. In our security model this means that we have a role template Manager, which is associated with ClientPermission. ClientPermission has one attribute clientType, which represents the type of the client.

Users are associated with roles, which are created from role templates. To create a role from a role template, we give values to all the attributes of the associated permissions. Let's create three roles from the Manager role template: StudentManager, StandardManager and VIPManager:

These roles can now be associated with users. For example, Jane is VIP manager:

Attributes of role templates can be used in constraints. In our model we compare the attribute of the protected object Loan with the attribute of the ClientPermission. If the values of the attributes are equal, then access is granted: