[smoyer]

I would suggest this is the perfect example of a project which should extend SCIM [1], a recently release RFS for this functionality. SCIM is Simple Cross-domain Identity Management and allows sharing of user and group information via RESTful JSON APIs. It's easily sufficient for vCard information and is also easily extensible. I think calendar and to-do information is the next step.

[1] http://www.simplecloud.info/

[madospace]

Amazing, I think if we keep identity management as a part of configuration then it will be easier for development, till one protocol becomes standard. I will try to add this as a default identity management. Thanks for the link.

[smoyer]

Our group is responsible for building and maintaining 108 applications. We were tired of building user-permission systems into every application, so standardizing our user and group system around SCIM solved half of the problem. For a standardized way of managing roles-permissions, we've adopted the ANSI RBAC [1] standard. The Apache Directory project's Fortress [2] sub-project is compliant with the ANSI RBAC specification and also implements ARBAC principles for role and permission administration.

The final piece of our centralized Authentication and Authorization strategy is a security server that allows a client with an OAuth2 Bearer token to access the user-group system, role-permission system, and to authenticate to our applications on behalf of a user using JWT. We're still working on a UI that will allow delegated administration (we've got 200k active users to manage) so that a manager will be granted the right to administer certain roles-permissions and it's then their responsibility for making sure their employees have the appropriate permissions.

We're in the process of adding ABAC style permissions so that we can manage user access in n-dimensions while slicing data (an employee might be allowed to manage financial data per the RBAC roles they're assigned but we also need to make sure they can only charge expenses to accounts that they're responsible for and potentially to apply limits to what they can spend without higher approval).

The first parts of our system are functional and we'll be rolling several applications with simpler permissions out over the next two months. We've actually been thinking about this problem for over three years, implemented the first of the ANSI RBAC roles over two years ago and we're finally getting the last pieces in place to make the whole system work. The only outstanding question is whether we can create a centralized UI for managing ABAC controls since these controls commonly require the context of the external application to make any sense.

In any case, I hope the two links below help!

[1] http://csrc.nist.gov/groups/SNS/rbac/documents/draft-rbac-im...

[2] http://directory.apache.org/fortress/

P.S. I should also mention that the system that's been running for two years now provides RBAC for over 3M users with our non-privileged accounts.

[madospace]

User roles-permission is indeed a complicated problem to solve. But do you think this will need so much complication?

As far as I think, it is straight forward. But I also agree when you work in a complicated hierarchy, you probably need these systems.

[smoyer]

No ... I don't think you would need roles and permissions for the task project but since you were enthusiastic about the user and groups I thought I'd pass along a solution for a comprehensive (but external) user management system.

EDIT: I also should have mentioned that we're updating our original system to be compliant with the specification and open sourcing [1] the code that's not custom to our application.

[1] https://github.com/PennState/scim