Role-Based Access Control in Software Services: Theory vs. Practice

This paper deals with the authorization management in software services. In particular, it presents the role-based access control (RBAC) approach and elaborates it in several directions to suit the needs of real services. As an example, a complex information system developed and deployed at VSB - Technical University of Ostrava is considered. Here, RBAC is made use of as a base model for administration of users´ privileges. We explore several approaches how to extend the base RBAC model and how to build it automatically. Those ideas are confronted with the reality encountered in the development of the university information system and experiences are discussed.