Example - 1

This code allows someone with the role of "ADMIN" or "OPERATOR" to reset a user's password. The role of "OPERATOR" is intended to have less privileges than an "ADMIN", but still be able to help users with small issues such as forgotten passwords.

ADMIN,OPERATOR,USER,GUEST

System.out.println("You are not authorized to perform this command");break;

System.out.println("You are not authorized to perform this command");break;

setPassword(user,password);break;case GUEST:case USER:default:}switch(requestingUser.role){}
System.out.println("You must be logged in to perform this command");if(isAuthenticated(requestingUser)){else{}public enum Roles {}public void resetPassword(User requestingUser, User user, String password ){}

This code does not check the role of the user whose password is being reset. It is possible for an Operator to gain Admin privileges by resetting the password of an Admin account and taking control of that account.