RBAC, pitfall or challenge?

A funny meeting has been held a few days ago while a topic has raised clinical researcher's interest in making good clinical software by using proper role based access control model. It seems to me that RBAC model has been a traditional topic among university students in CS Faculty. It could be a never-ending story when people are trying to find a way to create a generic model for general clinical applications.

When talking about managing tons of various e-health projects, people are always excited in finding an ultimate way to replicate existing model and turn it into a new one. This seems to be a revolution. They might imagine there should be plug-in available for all those web projects they have been working on. A gadget like this might cause those developers to scratch the hairs out of their heads. People might call it generic authentication module or generic adapter for user authentication.

On typical Active Directory based authentication model, local users are authenticated against a central AD server within the domain. How can we apply similar concept of this to make it working among various clinical applications?

We may see those applications as middle clients who need to authenticate the down-stream users for giving out access right and assigning user privilege. The central authentication module can be simply a database instance which stores all those user privileges and functional access rights while the popular webapps hosting on Apache server can make use of the database for central authentication. Different webapps will need different set of data tables to uniquely identify a user particularly for them. The good thing is that we can manage the authentication module at a central location while all other webapps will need to contact this module to collect necessary information for authentication and assigning proper access right to all kinds of features and functions provided locally in the webapps.

I can only tell this is not a new concept but people will realize the convenience of constructing new web projects with an easy way to incorporate user authentication from a third-party database server. Furthermore, we can construct API to bridge those applications developed on Java, C# or Python. This makes me aware of the term called "User Master Index". Similar to managing those patient records, it is more likely for the developers to construct something like "Patient Master Index". They serve the same purpose for a central management of user/patient identity which would be sharing among the applications. Also, the process of constructing the webapps becomes much more efficient.