I also thought that having a separate db can be used. But then we can also have this issue. If you do queries and you end up parsing the two db's you can also have conflicts. And a password can be the same for more than one user/resource.
This is why using a UID and DES could solve this. the UID will be a unique number (string) and the DEScriptor can be a string or qualifier to show the type of resource. Group, Share, User etc.