Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rbac]

Role Based Access Control is a method of access controls where principals get access to resources through membership of permitted roles.

1
vote
0answers
50 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
2
votes
2answers
113 views

Microservices and RBAC using OIDC

I am currently working on migrating our users from an internal DB to an OIDC service (considering Cognito/Auth0/etc.), and I am trying to implement RBAC. Our backend is basically a bunch of ...
2
votes
1answer
228 views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
3
votes
3answers
66 views

RBAC: how to separately scope two resources that have a many-to-many relationship

I'm working on an application that needs access control. Basically, the problem I'm facing is this (heavily simplified): The application has two main sections: Files = File[] Contacts = Contact[] ...
0
votes
1answer
66 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
0
votes
1answer
118 views

Question about access control with RBAC and DAC

Here is the problem A company has 1250 employees and the employees have been trained to handle 4 job duties: Clerks: 1200 of the employees have been approved to work as clerks. To do ...
1
vote
1answer
37 views

Share Document within user group

I would like to share documents within groups and make sure that the member of each group can only access the documents shared in his/her group. Situation: There are 5 participants (A, B, C, D). ...
3
votes
0answers
82 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
1
vote
1answer
177 views

Is It Possible to Implement Rule-Based Access Control on Amazon Web Services?

I've gone through a few security tutorials on AWS and noted that each tutorial focused on role-based access control only. Has anyone used rule-based access control on AWS? If so, could you point me ...
1
vote
0answers
41 views

Access Control - RBAC 0 (Zero) - use case

In this image, in definition of RBAC0, for point 5, if we change the Union to Intersection, will happen and present a use case scenario for this.
0
votes
1answer
477 views

Difference between Non-discretionary and Role-based Access control?

What's the difference between Non-discretionary access control and Role-based Access Control? In CISSP book both mentioned in the different paragraph as in different entity. But In some other place (...
2
votes
0answers
414 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
7
votes
0answers
460 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
1
vote
1answer
2k views

Rights vs permissions vs priveleges

I have to write a node module for handling role-based access control. Users are stored in database, there are user groups, and there are system assets or functionality that users and groups can be ...
5
votes
1answer
2k views

RBAC0 RBAC1 RBAC2 RBAC3 — What do they mean?

I am familiar with the concept of role-based access control but have heard the terms RBAC0 etc. being thrown around. What do these really mean? I found this quote on a NIST website: In 1996, Sandhu,...
1
vote
0answers
377 views

How to implement RBAC on Ubuntu?

I'm looking for the best approach to implement RBAC for about 100 Ubuntu servers. Currently all users are created locally mostly via Chef and we have no user directory service. All users have access ...
1
vote
1answer
612 views

Authorization based on OASIS ABAC/RBAC/XACML approach

Is anybody aware of any open source .NET authorization solution based on OASIS ABAC/RBAC/XACML approach? I have found some visible amount of Java based solutions but it seems .NET is completely out ...
1
vote
0answers
58 views

ABAC Policy Formal Presentation

I am asked to answer a question but i can't find such info in the internet so i created this post. The problem is: An on-line paper company decide to give access to their customers depend on their ...
2
votes
2answers
1k views

Separation of Duties using RBAC

I'm reading an article about Role based Access Control, in section 6 (Separation of Duties) I didn't understand this part : Separation of duty can be either static or dynamic. Compliance with ...
3
votes
3answers
405 views

Implement RBAC for my application

I'm beginning to work on a new web app for which I require implementing Role-Based Access Control. I've identified three Roles for my application which will be Role 1, Role 2 and an Role 3. Each user ...
-1
votes
2answers
275 views

RBAC togehter with AAA?

I'm taking a network course and my teacher has not been answering my emails. I'm supposed to set up "Role based access using privileges with AAA" I thought RBAC and AAA stood in contrast to one and ...
3
votes
1answer
120 views

What are the security implications of having a dummy user account representing unauthenticated users?

In my web application, users are assigned to groups and groups are granted permissions on objects. The application exposes some objects to unauthenticated public users (i.e. people casually visiting ...
1
vote
1answer
643 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
2
votes
2answers
93 views

If authenticated user tries to access a restricted resource

If a user with authorization to access Resource A, tries to access Resource B (by trying to follow a URL), which of the following is a better course? Take them to a standard Access Denied Page, with ...
0
votes
1answer
326 views

Securing Java REST Api for Saas usecase

I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring). I had a look at ...
2
votes
1answer
69 views

Explain the concept of RBAC to limit the right of senior staff

If a senior staff got authority to makes changes in the financial records of an organization so can take the money out from the organization which is operated by junior staffs. can RBAC be implemented ...
2
votes
0answers
1k views

How do i find the number of relationships between user and permission in DAC and RBAC

This is a part of a homework. I don't want an answer, just a hint. Assume a system with N job positions. For job position i, the number of individual users in that position Ui, and the number of ...
2
votes
0answers
31 views

Unique assignment of permissions to objects seems to also require the role?

So my understanding of RBAC is that Users have Roles, and Roles have Permissions and there should be a Permission Object mapping. I'm having a bit of a business logic problem though concerning RBAC. ...
1
vote
1answer
93 views

Automated tools for applying formal methods to verify security policy in existing software

I am new to the Formal Methods arena, but I feel I have an educated grasp on its applications. However, I only seem to encounter formal methods as applied to the development process, as the software ...
6
votes
4answers
4k views

encryption vs access control comparison

I have a very basic and simple question about two security concepts. Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
13
votes
2answers
43k views

MAC vs DAC vs RBAC

Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
4
votes
5answers
738 views

Can someone please explain RBAC to me?

From http://msdn.microsoft.com/en-us/library/jj709705.aspx In contrast to the DAC model, which is oriented around objects, the AzMan RBAC model attempts to orient the common administrative experience ...
1
vote
1answer
149 views

ACL managed with roles

I have resources in an application. Further I have a table holding all resources and for every resource what role is allowed to access it. I also have defined a Table holding all uses that are ...
8
votes
1answer
8k views

What is the difference between claims, attributes, and roles?

Many questions have already been asked about Claims-based authentication and the differences with other approaches: Role-based vs Claims-based Explain claims-based authentication Now, my favorite ...
2
votes
2answers
259 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if (hasAssertion(...
0
votes
3answers
593 views

role based access control - same role, different departments

This question about RBAC implementation. Can a subject have a role in a certain realm? Suppose a university is made up of departments. Departments have courses. Courses have students. Students have ...
9
votes
1answer
1k views

What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?

In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
31
votes
2answers
17k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
4
votes
4answers
222 views

How can an Subject only read and write to its owned objects?

It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
20
votes
4answers
6k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to data ownership? For example: Bob is a doctor and has the role ...
13
votes
2answers
3k views

Best practices for implementation of role-based access control in healthcare applications

Amongst the open source EMRs, which ones may be good to learn from? Any references I can go to as a starting point?
5
votes
1answer
2k views

Is it correct to consider Task Based Access Control as a type of RBAC?

I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture: "Role Based Access Control doesn't always ...
5
votes
3answers
255 views

(custom software) Security rules on each record when using user-groups per application

I'm working with custom software here, so don't worry about Microsoft whatever, Open anything, or something else. Let’s stick to theory of how this should go together. Let’s say I have a user system/...
6
votes
3answers
2k views

Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account

How do large companies implement their security requirements which are centralized and used to drive things people can do (allowed to call a certain web-service, submit an order, etc.) as well as to ...
10
votes
4answers
2k views

RBAC model: user in two roles access dilemma

I am implementing the Role-Based Access Control (RBAC) model security system and I have a dilemma: one User1 is in Role1 and is in Role2. Role1 allows access to the Resource1 and Role2 denies access ...
58
votes
1answer
55k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...