Search code examples
javaauthenticationspring-securityauthorizationshiro

Java web application authentication - account design

I am working on a web project, backend is Java & Mysql, the client include web(html5) and app(IOS/Android), I have some doubt in design the account of the system.

There are 3 different types of account:

  • Shop, shop account will have its own website,
  • Customer, customer access shop/commodity via app(IOS/Android),
  • Admin, manage everything of the system.

My basic idea of authentication:

There will be account / role / permission table for sure, because both admin & customer will have quite complex user permission issue, customer also have different permission due to their history behavior.

I have kind decided to use Apache Shiro, due to its simplicity & distributed session.

My question is:

(1) Should I create a single account table or 3 individual account tables.

(2) Any advise on design of 3 tables: account / role / permission ?

Solution

  • To be short: you don't need role / permission tables :)

    I would decide first do you really need RBAC security model? Your application looks like a perfect use case for hexagonal architecture with 3 separate isolated front-end parts: Consumer, Shop, Admin. Then I would advise to build separate authentication/authorization mechanism for each of these front-ends. In this case you are flexible to choose the best tool for the purpose (OAuth2, OpenID, LDAP whatever) and follow least common mechanism security principle. Your application doesn't look like the one which needs authorization on method level, thus you don't need RBAC.