What is access control
Ignore particularly fine concept, such as a variety of rights that can be subdivided, function rights, data rights, management rights and so on.
We understand two concepts: users and resources, so that the specified user can only operate the specified resource (CRUD).
ACL: Access Control List Access Control Lists
A design authority prevailed in the past, its core is directly linked to users and permissions
Pros: Easy to use, convenient development
Cons: Users and permissions directly linked, resulting in complexity when granted, scattered, not easy to manage
Examples: common file system permissions design, add directly to the user permissions
RBAC: Role Based Access Control
Role-based access control system. Privileges associated with the role, users get privileges in those roles by becoming members of appropriate roles
Advantages: simplifies the management of users and permissions, classified by the user, so that the roles and privileges associated
Disadvantages: relatively complex development contrast ACL
Example: Based on RBAC permissions model validation framework and application Apache Shiro, spring Security
Summary: not too complicated, too many rules, maintainability and performance will decline, more categories ABAC, PBAC, etc.