Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cassandra.apache.org
Received-SPF: pass (nike.apache.org: domain of mac.miklas@googlemail.com
 designates 209.85.210.172 as permitted sender)
MIME-Version: 1.0
Reply-To: mac.miklas@gmail.com
Date: Tue, 20 Mar 2012 07:47:29 +0100
Message-ID: 
 <CALk=J59k=VygRKyq4mCJQLqgiqa0LhbATWfsUbqk66V4YqPX0Q@mail.gmail.com>
Subject: Cassandra as Database for Role Based Access Control System
From: Maciej Miklas <mac.miklas@googlemail.com>
To: user@cassandra.apache.org
Content-Type: multipart/alternative; boundary=e89a8fb1f476757d3204bba70c29

--e89a8fb1f476757d3204bba70c29
Content-Type: text/plain; charset=UTF-8

Hi *,

I would like to know your opinion about using Cassandra to implement a
RBAC-like authentication & authorization model. We have simplified the
central relationship of the general model (
http://en.wikipedia.org/wiki/Role-based_access_control) to:

user ---n:m--- role ---n:m--- resource

user(s) and resource(s) are indexed with externally visible identifiers.
These identifiers need to be "re-ownable" (think: mail aliases), too.

The main reason to consider Cassandra is the availability, scalability and
(global) geo-redundancy. This is hard to achieve with a RBDMS.

On the other side, RBAC has many m:n relations. While some inconsistencies
may be acceptable, resource ownership (i.e. role=owner) must never ever be
mixed up.

What do you think? Is such relational model an antipattern for Cassandra
usage? Do you know similar solutions based on Cassandra?


Regards,

Maciej


ps. I've posted this question also on stackoverflow, but I would like to
also get feedback from Cassandra community.

--e89a8fb1f476757d3204bba70c29
Content-Type: text/html; charset=UTF-8

<div class="post-text">
        <p>Hi *,<br></p><p>I would like to know your opinion about using Cassandra to implement a
RBAC-like authentication &amp; authorization model. We have simplified the
central relationship of the general model
(<a href="http://en.wikipedia.org/wiki/Role-based_access_control">http://en.wikipedia.org/wiki/Role-based_access_control</a>) to:</p>

<p>user ---n:m--- role ---n:m--- resource</p>

<p>user(s) and resource(s) are indexed with externally visible identifiers.
These identifiers need to be &quot;re-ownable&quot; (think: mail aliases), too.</p>

<p>The main reason to consider Cassandra is the availability, scalability
and (global) geo-redundancy. This is hard to achieve with a RBDMS.</p>

<p>On the other side, RBAC has many m:n relations. While some
inconsistencies may be acceptable, resource ownership (i.e. role=owner)
must never ever be mixed up.</p>

<p>What do you think? Is such relational model an antipattern for Cassandra
usage? Do you know similar solutions based on Cassandra?</p><p><br></p><p>Regards,</p><p>Maciej</p><p><br></p><p>ps. I&#39;ve posted this question also on stackoverflow, but I would like to also get feedback from Cassandra community.<br>
</p><p><br></p><p><br></p><p><br></p>

    </div>

--e89a8fb1f476757d3204bba70c29--