Fulcrum Security – Example of the security models

Example

Requirements

This is example is inspired in Scarab but it doesn't follow it exactly. The system controls bug reports in a software project. The system allows the following operations.

create an issue.
view an issue.
modify an issue.
close an issue.

The system is able to manage several projects.

Project A.
Project B.

And there are several roles in each project:

Manager - It can create an issue, view an issue, modify an issue and close an issue.
Developer - It can create an issue, view an issue and modify an issue.
Observer - It can view an issue.

Project A has the following roles and users:

Salma is the manager.
Britney and Demi are developers.
Cameron is an observer.

Project B has the following roles and users:

Demi is the manager.
Madona and Britney are developers.
Barbara is an observer.

Turbine

Declare two groups. One for each project.
Declare four permissions. One for each operation.
Declare three roles. Manager, Developer and Observer
Create users for Salma, Britney, Demi, Cameron, Madona and Barbara
Grant Salma the role of manager in project A.
Grant Britney the role of develop in projects A and B.
Grant Demi the role of developer in project A and the role of manager in project B
Grant Cameron the role of observer in project A.
Grant Madona the role of developer in project B.
Grant Barbara the role of observer in project B.

Dynamic

Declare a group of "managers for project A"
Declare a group of "developers for project A"
Declare a group of "observers for project A"
Declare a group of "managers for project B"
Declare a group of "developers for project B"
Declare a group of "observers for project B"
Declare four permissions. One for each operation.
Declare three roles. Manager, Developer and Observer
Declare another three groups. One for each role.
Declare another two roles. One for each
Create users for Salma, Britney, Demi, Cameron, Madona and Barbara
Make Salma, Britney, Demi and Cameron part of group "project A".
Make Demi, Madona, Britney and Barbara part of group "project B".

We need to do more work on this

Basic

Declare two groups. One for each project
Create users for Salma, Britney, Demi, Cameron, Madona and Barbara
Make Salma, Britney, Demi and Cameron part of group "project A".
Make Demi, Madona, Britney and Barbara part of group "project B".

With this configuration you can control that one project is afected only by the members of the project. However, you don't have control over which operations can be done by each member within the project.