Role Based Access Control is a method of access controls where principals get access to resources through membership of permitted roles.

learn more… | top users | synonyms

-1
votes
2answers
36 views

RBAC togehter with AAA?

I'm taking a network course and my teacher has not been answering my emails. I'm supposed to set up "Role based access using privileges with AAA" I thought RBAC and AAA stood in contrast to one and ...
3
votes
1answer
66 views

What are the security implications of having a dummy user account representing unauthenticated users?

In my web application, users are assigned to groups and groups are granted permissions on objects. The application exposes some objects to unauthenticated public users (i.e. people casually visiting ...
1
vote
1answer
111 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
2
votes
2answers
49 views

If authenticated user tries to access a restricted resource

If a user with authorization to access Resource A, tries to access Resource B (by trying to follow a URL), which of the following is a better course? Take them to a standard Access Denied Page, with ...
0
votes
1answer
106 views

Securing Java REST Api for Saas usecase

I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring). I had a look at ...
1
vote
1answer
38 views

Explain the concept of RBAC to limit the right of senior staff

If a senior staff got authority to makes changes in the financial records of an organization so can take the money out from the organization which is operated by junior staffs. can RBAC be implemented ...
2
votes
0answers
199 views

How do i find the number of relationships between user and permission in DAC and RBAC

This is a part of a homework. I don't want an answer, just a hint. Assume a system with N job positions. For job position i, the number of individual users in that position Ui, and the number of ...
2
votes
0answers
25 views

Unique assignment of permissions to objects seems to also require the role?

So my understanding of RBAC is that Users have Roles, and Roles have Permissions and there should be a Permission Object mapping. I'm having a bit of a business logic problem though concerning RBAC. ...
1
vote
1answer
70 views

Automated tools for applying formal methods to verify security policy in existing software

I am new to the Formal Methods arena, but I feel I have an educated grasp on its applications. However, I only seem to encounter formal methods as applied to the development process, as the software ...
3
votes
3answers
620 views

encryption vs access control comparison

I have a very basic and simple question about two security concepts. Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
4
votes
5answers
343 views

Can someone please explain RBAC to me?

From http://msdn.microsoft.com/en-us/library/jj709705.aspx In contrast to the DAC model, which is oriented around objects, the AzMan RBAC model attempts to orient the common administrative experience ...
1
vote
1answer
104 views

ACL managed with roles

I have resources in an application. Further I have a table holding all resources and for every resource what role is allowed to access it. I also have defined a Table holding all uses that are ...
5
votes
1answer
5k views

What is the difference between claims, attributes, and roles?

Many questions have already been asked about Claims-based authentication and the differences with other approaches: Role-based vs Claims-based Explain claims-based authentication Now, my favorite ...
2
votes
2answers
184 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if ...
0
votes
3answers
261 views

role based access control - same role, different departments

This question about RBAC implementation. Can a subject have a role in a certain realm? Suppose a university is made up of departments. Departments have courses. Courses have students. Students have ...
9
votes
1answer
822 views

What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?

In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
24
votes
2answers
10k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
4
votes
4answers
199 views

How can an Subject only read and write to its owned objects?

It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
16
votes
4answers
4k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership? For example: Bob is a doctor and has the role ...
11
votes
2answers
2k views

Best practices for implementation of role-based access control in healthcare applications

Amongst the open source EMRs, which ones may be good to learn from? Any references I can go to as a starting point?
4
votes
1answer
1k views

Is it correct to consider Task Based Access Control as a type of RBAC?

I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture: "Role Based Access Control doesn't ...
4
votes
3answers
223 views

(custom software) Security rules on each record when using user-groups per application

I'm working with custom software here, so don't worry about Microsoft whatever, Open anything, or something else. Let’s stick to theory of how this should go together. Let’s say I have a user ...
5
votes
3answers
2k views

Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account

How do large companies implement their security requirements which are centralized and used to drive things people can do (allowed to call a certain web-service, submit an order, etc.) as well as to ...
10
votes
4answers
1k views

RBAC model: user in two roles access dilemma

I am implementing the Role-Based Access Control (RBAC) model security system and I have a dilemma: one User1 is in Role1 and is in Role2. Role1 allows access to the Resource1 and Role2 denies access ...
36
votes
1answer
30k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...