Role-Based Access Control on the Web

Joon S. Park, Ravi Sandhu, Gail Joon Ahn

Research output: Contribution to journalArticlepeer-review

165 Scopus citations


Current approaches to access control on Web servers do not scale to enterprise-wide systems because they are mostly based on individual user identities. Hence we were motivated by the need to manage and enforce the strong and efficient RBAC access control technology in large-scale Web environments. To satisfy this requirement, we identify two different architectures for RBAC on the Web, called user-pull and server-pull. To demonstrate feasibility, we implement each architecture by integrating and extending well-known technologies such as cookies, X.509, SSL, and LDAP, providing compatibility with current Web technologies. We describe the technologies we use to implement RBAC on the Web in different architectures. Based on our experience, we also compare the tradeoffs of the different approaches.

Original languageEnglish (US)
Pages (from-to)37-71
Number of pages35
JournalACM Transactions on Information and System Security
Issue number1
StatePublished - 2001
Externally publishedYes


  • Cookies
  • Design
  • Digital certificates
  • Experimentation
  • Role-Based access control
  • Security
  • WWW security

ASJC Scopus subject areas

  • General Computer Science
  • Safety, Risk, Reliability and Quality


Dive into the research topics of 'Role-Based Access Control on the Web'. Together they form a unique fingerprint.

Cite this