Good resources for writing a Authentication/Authorization system

Question

Are there any good books, blogs, wiki's, etc, on coding security systems? and standards that should be followed? I'm specifically interested in writing Access Control (DAC, MAC, RBAC) and auditing. I think I have a solid working understanding of DAC due to my experience with *nix systems. But I don't know what goes into implementing these systems (example: I believe there is a standard for RBAC?) and would like to learn.

Most of this should be language independent, but language dependent resources are welcome.

update yes I know there are lots of existing modules and about NIH Syndrome and Don't Reinvent the wheel... however sometimes you have to reinvent the wheel for educational purposes. Someone has to know how to build security systems, and they have to start learning somewhere.

update I decided to make this a Community Wiki because I doubt there is any 1 good answer and I think it could be an important resource.

Answer 1

Some of the pioneering work on RBAC was done by NIST (esp this paper). Still good for conceptual background.

Answer 2

If you want to build real fine-grained access control (FGAC), just check my article on this subject for MySQL :

MySQL 5.0 Fine-Grained Access Control (FGAC)

Basically, you don't want your business code be dependent on the FGAC implementation, you don't want to mix FGAC code in where clause of the select statements of your business rules. This article shows solutions to avoid cluttering of SQL statements.