title: User - Group - Permission User Interface design for ASP.NET MVC
body: <p>New at ASP.NET MVC.  I am looking for some UI design ideas not entirely specific to MVC.  There is probably not an exact answer but here is what I have started.  </p>
  
  <p>There would need to be a page with 3 tabs on it.
  Permissions  |   Groups |     Users</p>
  
  <p>1) Permissions View would allow you to do CRUD operations on Permissions in a Grid
  Delete on a specific permission is only allowed when the permission is not being used in any Group.</p>
  
  <p>2) On Groups View, CRUD operations on Groups are allowed in grid.
  Also, a Permissions link is provided that will allow to do mapping (Add/Remove) Permissions for a Group
  Again, a DELETE operation on a Group is only allowed when the Group is not being used by any User.</p>
  
  <p>3) On Users View, all the existing Users in the system will be presented.  The grid show allow for searching a user by username, first name or last name.
  Groups link should be provided for each user that when clicked allows to do mapping (Add/Remove) Groups for a User.
  Below this mapping in the same view, a separate section of Permission Overrides should be provided so that a specific permission can be added with IsGranted (true/false).</p>
  
  <p>Description of the database design:</p>
  
  <p><img src="https://i.stack.imgur.com/Glht1.png" alt="enter image description here"></p>
  
  <p>1) Groups will be assigned Permissions.  Based on the group that the user belongs to, User will get the Permissions.</p>
  
  <p>2) UserPermissionOverrides will handle the scenario where 
  - a User needs to be granted certain permissions (regardless of the role they are in) or
  - if certain permissions need to be revoked from a user, even if they belong to a certain group. 
  This will allow us good flexibility to handle the special scenarios of adding or removing specific permissions. </p>
  
  <p>So, when the user logs in - 1) above will be used to retrieve the group permissions for a user and then 2) will be executed to retrieve the overrides (granted/revoked).  Combining 1) and 2) will give us the final permissions for the user which will then get stored in the forms authentication cookie to prevent further database hits</p>