Access Control Lists basics

I'm gonna add authorization, user and groups management to my application, basically... you will can define a set of permissions for a concrete user or group. For example, you could specify whom can use a concrete resource.

So I want to ensure that my assumptions about ACLs are right:

• A basic rule could be "Grant", "Deny", "NoSet".
• User permissions have priority over group permissions.
• "Deny" statement has priority over "Grant".

For example, user "u1" belongs to group "A", the resource "X" has this ACL "u1:grant,A:deny" user "u1" shoul开发者_高级运维d be able to access the resource, shouldn't it?

If a resource has no ACL set... does it means that anyone can access it? should I provide a default ACL?

Any document about ACL in a general way?

User permissions have priority over group permissions.

this contradicts with third. You should take union of permissions of user and group. There is no priority, operation is binary - either permission is in this set or not.

Deny denies everything: user and group permissions.