Implementing Role-Based Access Control (RBAC): Using PHP and RBAC

With the popularity of Internet applications, we hope to protect data within the application to ensure that sensitive data is not misused or stolen. One of the solutions is to use role-based access control (RBAC).

Role-based access control (RBAC) is an access control model based on the relationship between users and roles. The core idea of ​​this model is to link the user's role to the access control operation, rather than linking the access control operation directly to the user. This approach increases the flexibility of access control and enables administrators to more easily manage users.

In this article, we will use PHP and RBAC to implement a basic user access control system. Here are the tables we will use:

• users: Used to store information about registered users.
• roles: Used to store role-centric access permission lists.
• user_roles: used to store the roles to which the user belongs.
• permissions: used to store permission lists and access control lists.
• role_permissions: used to store the list of permissions owned by the role.

We will use the following steps to implement our RBAC control system:

Step 1: Create a database and establish the tables related to it

In the MySQL database Create a new database and set up the following 4 tables:

CREATE TABLE users (
    id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    password VARCHAR(255) NOT NULL,
    email VARCHAR(100) NOT NULL UNIQUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE roles (
    id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(100) UNIQUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE user_roles (
    id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
    user_id INT(11) NOT NULL,
    role_id INT(11) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY user_id_fk (user_id) REFERENCES users(id),
    FOREIGN KEY role_id_fk (role_id) REFERENCES roles(id)
);

CREATE TABLE permissions (
    id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(100) UNIQUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE role_permissions (
    id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
    role_id INT(11) NOT NULL,
    permission_id INT(11) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY role_id_fk (role_id) REFERENCES roles(id),
    FOREIGN KEY permission_id_fk (permission_id) REFERENCES permissions(id)
);

Step 2: Write PHP code

We will implement a basic PHP class to handle our RBAC control system. This class will allow us to add users, add roles, add permissions, assign users to roles and assign permissions to roles.

class Rbac {

  // 数据库连接和表名
  private $conn;
  private $users_table = "users";
  private $roles_table = "roles";
  private $user_roles_table = "user_roles";
  private $permissions_table = "permissions";
  private $role_permissions_table = "role_permissions";

  // 构造函数将数据库连接
  public function __construct($db) {
    $this->conn = $db;
  }

  // 添加用户
  public function addUser($username, $password, $email) {
    // 生成密码哈希
    $password_hash = password_hash($password, PASSWORD_BCRYPT);
    // 插入用户到数据库
    $query = "INSERT INTO " . $this->users_table . "(username, password, email) VALUES (:username, :password, :email)";
    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(":username", $username);
    $stmt->bindParam(":password", $password_hash);
    $stmt->bindParam(":email", $email);
    if($stmt->execute()) {
      return true;
    } else {
      return false;
    }
  }

  // 添加角色
  public function addRole($name) {
    $query = "INSERT INTO " . $this->roles_table . "(name) VALUES (:name)";
    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(":name", $name);
    if($stmt->execute()) {
      return true;
    } else {
      return false;
    }
  }

  // 添加权限
  public function addPermission($name) {
    $query = "INSERT INTO " . $this->permissions_table . "(name) VALUES (:name)";
    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(":name", $name);
    if($stmt->execute()) {
      return true;
    } else {
      return false;
    }
  }

  // 将用户分配给角色
  public function assignUserRole($user_id, $role_id) {
    $query = "INSERT INTO " . $this->user_roles_table . "(user_id, role_id) VALUES (:user_id, :role_id)";
    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(":user_id", $user_id);
    $stmt->bindParam(":role_id", $role_id);
    if($stmt->execute()) {
      return true;
    } else {
      return false;
    }
  }

  // 将权限分配给角色
  public function assignRolePermission($role_id, $permission_id) {
    $query = "INSERT INTO " . $this->role_permissions_table . "(role_id, permission_id) VALUES (:role_id, :permission_id)";
    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(":role_id", $role_id);
    $stmt->bindParam(":permission_id", $permission_id);
    if($stmt->execute()) {
      return true;
    } else {
      return false;
    }
  }

}

We now have a simple class that can add users, add roles, add permissions, assign users to roles and assign permissions to roles.

Step 3: Test

We can now create a test script to test our RBAC control system. The following is the sample code:

// 包括我们的RBAC类
include_once 'Rbac.php';

// 设置数据库连接
$database = new PDO("mysql:host=localhost;dbname=testdb", "username", "password");

// 定义RBAC类
$rbac = new Rbac($database);

// 添加用户
$rbac->addUser("user1", "password1", "user1@example.com");
$rbac->addUser("user2", "password2", "user2@example.com");

// 添加角色
$rbac->addRole("admin");
$rbac->addRole("editor");
$rbac->addRole("user");

// 添加权限
$rbac->addPermission("create");
$rbac->addPermission("read");
$rbac->addPermission("update");
$rbac->addPermission("delete");

// 将用户分配给角色
$rbac->assignUserRole(1, 1); // user1 is assigned the admin role
$rbac->assignUserRole(1, 3); // user1 is also assigned the user role
$rbac->assignUserRole(2, 2); // user2 is assigned the editor role

// 将权限分配给角色
$rbac->assignRolePermission(1, 1); // admin role is assigned the create permission
$rbac->assignRolePermission(1, 2); // admin role is assigned the read permission
$rbac->assignRolePermission(1, 3); // admin role is assigned the update permission
$rbac->assignRolePermission(1, 4); // admin role is assigned the delete permission
$rbac->assignRolePermission(3, 2); // user role is assigned the read permission

// 提示测试完成
echo "Test complete!";

The above test script will execute our RBAC control system and will add a user, 3 different roles, 4 different permissions, then assign the user to the role, and assign the permissions assigned to each role.

Conclusion

In this article, we have learned how to implement role-based access control using PHP and RBAC. We have built a simple RBAC control system that can add users, add roles, add permissions, assign users to roles and assign permissions to roles. In practical applications, the RBAC control system can be more routine and complex, which requires us to expand and improve it according to the actual situation.

The above is the detailed content of Implementing Role-Based Access Control (RBAC): Using PHP and RBAC. For more information, please follow other related articles on the PHP Chinese website!