For many of my apps, I use the same security architecture that stores a user's roles on the database in their UserAccount table. The roles column is a varchar of comma-seperated keywords, each representing a different role. This is working fine, but I need a more flexible and efficient methodology.
What I'm starting to move toward is using an integer and bitwise operations to determine a user's role. This saves in storage and is quicker in most of my findings. The long and short of how this works is that if I have 5 different roles, they make up the first 5 bits of a binary string. So 11111 means they have all roles, this is stored as the integer 31. Then, if I want to check if they have, say, the 4th role, I do a bitwise and something like this:
if((requiredRolesStr&userRolesStr) == requiredRolesStr)
//they pass
Go to the complete details ...