Role Based Access Control is a method of access controls where principals get access to resources through membership of permitted roles.

learn more… | top users | synonyms

22
votes
1answer
13k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...
10
votes
2answers
1k views

Best practices for implementation of role-based access control in healthcare applications

Amongst the open source EMRs, which ones may be good to learn from? Any references I can go to as a starting point?
10
votes
4answers
2k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership? For example: Bob is a doctor and has the role ...
9
votes
4answers
841 views

RBAC model: user in two roles access dilemma

I am implementing the Role-Based Access Control (RBAC) model security system and I have a dilemma: one User1 is in Role1 and is in Role2. Role1 allows access to the Resource1 and Role2 denies access ...
8
votes
2answers
3k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
7
votes
1answer
350 views

What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?

In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
5
votes
3answers
1k views

Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account

How do large companies implement their security requirements which are centralized and used to drive things people can do (allowed to call a certain web-service, submit an order, etc.) as well as to ...
4
votes
3answers
180 views

(custom software) Security rules on each record when using user-groups per application

I'm working with custom software here, so don't worry about Microsoft whatever, Open anything, or something else. Let’s stick to theory of how this should go together. Let’s say I have a user ...
4
votes
1answer
845 views

Is it correct to consider Task Based Access Control as a type of RBAC?

I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture: "Role Based Access Control doesn't ...
4
votes
5answers
112 views

Can someone please explain RBAC to me?

From http://msdn.microsoft.com/en-us/library/jj709705.aspx In contrast to the DAC model, which is oriented around objects, the AzMan RBAC model attempts to orient the common administrative experience ...
4
votes
4answers
165 views

How can an Subject only read and write to its owned objects?

It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
2
votes
2answers
99 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if ...
1
vote
1answer
720 views

What is the difference between claims, attributes, and roles?

Many questions have already been asked about Claims-based authentication and the differences with other approaches: Role-based vs Claims-based Explain claims-based authentication Now, my favorite ...
0
votes
2answers
109 views

role based access control - same role, different departments

This question about RBAC implementation. Can a subject have a role in a certain realm? Suppose a university is made up of departments. Departments have courses. Courses have students. Students have ...
0
votes
1answer
26 views

ACL managed with roles

I have resources in an application. Further I have a table holding all resources and for every resource what role is allowed to access it. I also have defined a Table holding all uses that are ...