title: Access Control in ASP.NET MVC using  [Flags] based Enum to int permissions management in SQL
body: <p>This question is inspired by <a href="https://stackoverflow.com/q/1335315/328397">this SO question regarding Access Control</a> in ASP.NET MVC.  Here I'm trying to bring the accepted answer into a tangible solution.</p>
  
  <p>The answer mentions using <code>FileSystemSecurity</code> as an inspiration to managing permissions.  Here I'm also using an enum with Flags attribute to define the ACL for all my objects.   Additionally each member of my objects will be stored in a column within SQL.  Assume a simplified Linq2SQL, EF, or nHibernate ORM mapping.</p>
  
  <p><strong>Edit: Added the following benefit / rationale for this approach</strong></p>
  
  <p>This security model was inspired by the <a href="http://msdn.microsoft.com/en-us/library/system.security.accesscontrol.filesystemrights.aspx" rel="nofollow noreferrer">FileSystemRights</a>, the .NET approach to managing file level permissions. </p>
  
  <p>One of the main reasons I like this approach is so I can easily create a summary of all the permissions by OR'ing all the individual ACLs together.  I also like that I can add a DENY ACL to remove an inherited permission.</p>
  
  <pre><code>List&lt;myObject&gt; PermissionsList  = GetACLForObject(ItemID, UserID);
  foreach (var acl in PermissionsList)
  {
     // The following enum has the [FlagsAttribute] applied so the .ToString() is pretty 
     PermissionWithFlagsEnum sampleForSO = (PermissionWithFlagsEnum )acl.Permission;
  
     Console.Writeline ("Setting " + sampleForSO.ToString() + " permission for group: " + acl.ACLName);
  
     ResultingPermission = resultPermission |  acl.Permission ; 
  }
  public int ResultingPermission {get;set;}
  </code></pre>
  
  <p><strong>/End Edit</strong></p>
  
  <p>Then it occurred to me that I could compare less privileged users by numeric value of the <code>enum</code> from more privileged users's <code>enum</code>.</p>
  
  <p>I'm thinking that this definition would allow for quick and easy identification of users within the SQL database, without having to parse the enum on the backend.  ( Find unprivileged users via <code>select users from permissions where security &lt; DBAceessRights.DetailRead</code> )</p>
  
  <p>Here is how I defined the flags (lowest value has the least permission)</p>
  
  <pre><code>[Flags]
  public enum DBAccessRights
  {
      DenyAll  =1 &lt;&lt; 1,
  
      WikiMode = 1 &lt;&lt; 4,
  
      AppearInListing = 1 &lt;&lt; 8,
  
      DetailRead = 1 &lt;&lt; 12,
  
      CreateNew = 1 &lt;&lt; 18,
  
      DetailEdit = 1 &lt;&lt; 22,
  
      DeleteChild = 1 &lt;&lt; 26,
  
      DeleteThis = 1 &lt;&lt; 30,
  
      EditPermissions = 1 &lt;&lt; 31,
  
  }
  </code></pre>
  
  <p>I have a <a href="https://i.imgur.com/ONw9k.png" rel="nofollow noreferrer">permission table</a> that joins a user ID to an object specific ACE.  This should reduce the need for concurrent updates on a particular row. 
  <img src="https://i.stack.imgur.com/CUVBR.png" alt="enter image description here"></p>
  
  <p><strong>Question</strong></p>
  
  <ul>
  <li><p>Is this a good idea?</p></li>
  <li><p>Has someone done it before (better than this)? (Edit: <a href="https://stackoverflow.com/q/1335315/328397">It is the accepted answer here</a> )</p></li>
  <li><p>If this is a standard way of implementing permissions, what is it called?</p></li>
  </ul>