Questions tagged [rbac]

Role Based Access Control is a method of access controls where principals get access to resources through membership of permitted roles.

Filter by
Sorted by
Tagged with
1 vote
0 answers
83 views

Attempting to Implement RBAC from ACL

I am trying to implement RBAC to a system but I endup creating an ACL instead due to my low understanding of this archtecture. What I already have implemented: Created User model. Created Groups with ...
user avatar
0 votes
1 answer
79 views

Should access control be managed from inside application?

I am a developer who's just starting to learn about authorization and authentication for web apps. I am bit unclear on the concept of managing access control to parts of the app, and where is the best ...
user avatar
  • 113
0 votes
1 answer
130 views

EXECUTE AS impersonation

I wrote a web application that is using AD authentication (Windows) and has it's own authorization module (RBAC like). Backend is SQL Server. A DBA on my team is not happy with us using a service ...
user avatar
0 votes
1 answer
80 views

Is it ok to send roles and permissions data to the browser in a RBAC system?

I have a backend with a simple RBAC implementation. We have a list of permissions, each permission is associated with a list of roles, each user is given one or more roles. Is it ok to send this ...
user avatar
1 vote
1 answer
152 views

How to implement MySQL query fo RBAC authorization with fine grained business restrictions in role?

When implementing an authorization system like RBAC/DAC, or XACML, or the AWS IAM authorization model, I see that I can't totally decouple business logic from authorization when there are fine-grained ...
user avatar
1 vote
1 answer
94 views

Is it good or bad to use group in sudoers file instead of using aliases?

I have used user groups heavily while designing access control policies. I find user groups very convenient as it's very easy to implement with PAM. Another reason I have organized the users with ...
user avatar
  • 1,078
4 votes
2 answers
594 views

How to design an Access Control system that is quick to implement and understand, yet maintainable and flexible enough?

We're currently redesigning our access control system for our SaaS startup (over the past two years it has grown alongside the business and decided to clean it up at this point). The access control ...
user avatar
  • 41
1 vote
0 answers
120 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
user avatar
5 votes
2 answers
2k views

Microservices and RBAC using OIDC

I am currently working on migrating our users from an internal DB to an OIDC service (considering Cognito/Auth0/etc.), and I am trying to implement RBAC. Our backend is basically a bunch of ...
user avatar
4 votes
1 answer
4k views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
user avatar
  • 171
3 votes
3 answers
277 views

RBAC: how to separately scope two resources that have a many-to-many relationship

I'm working on an application that needs access control. Basically, the problem I'm facing is this (heavily simplified): The application has two main sections: Files = File[] Contacts = Contact[] ...
user avatar
  • 133
0 votes
1 answer
170 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
user avatar
  • 157
0 votes
1 answer
887 views

Question about access control with RBAC and DAC

Here is the problem A company has 1250 employees and the employees have been trained to handle 4 job duties: Clerks: 1200 of the employees have been approved to work as clerks. To do ...
user avatar
1 vote
1 answer
85 views

Share Document within user group

I would like to share documents within groups and make sure that the member of each group can only access the documents shared in his/her group. Situation: There are 5 participants (A, B, C, D). ...
user avatar
3 votes
0 answers
179 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
user avatar
1 vote
1 answer
261 views

Is It Possible to Implement Rule-Based Access Control on Amazon Web Services?

I've gone through a few security tutorials on AWS and noted that each tutorial focused on role-based access control only. Has anyone used rule-based access control on AWS? If so, could you point me ...
user avatar
1 vote
0 answers
99 views

Access Control - RBAC 0 (Zero) - use case

In this image, in definition of RBAC0, for point 5, if we change the Union to Intersection, will happen and present a use case scenario for this.
user avatar
  • 11
0 votes
1 answer
869 views

Difference between Non-discretionary and Role-based Access control?

What's the difference between Non-discretionary access control and Role-based Access Control? In CISSP book both mentioned in the different paragraph as in different entity. But In some other place (...
user avatar
  • 1,078
2 votes
0 answers
589 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
user avatar
13 votes
1 answer
1k views

Separating "function" from "scope" in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
user avatar
  • 231
4 votes
2 answers
6k views

Rights vs permissions vs privileges

I have to write a node module for handling role-based access control. Users are stored in database, there are user groups, and there are system assets or functionality that users and groups can be ...
user avatar
  • 155
6 votes
1 answer
4k views

RBAC0 RBAC1 RBAC2 RBAC3 -- What do they mean?

I am familiar with the concept of role-based access control but have heard the terms RBAC0 etc. being thrown around. What do these really mean? I found this quote on a NIST website: In 1996, Sandhu,...
user avatar
  • 1,410
1 vote
0 answers
776 views

How to implement RBAC on Ubuntu?

I'm looking for the best approach to implement RBAC for about 100 Ubuntu servers. Currently all users are created locally mostly via Chef and we have no user directory service. All users have access ...
user avatar
1 vote
1 answer
1k views

Authorization based on OASIS ABAC/RBAC/XACML approach

Is anybody aware of any open source .NET authorization solution based on OASIS ABAC/RBAC/XACML approach? I have found some visible amount of Java based solutions but it seems .NET is completely out ...
user avatar
  • 113
6 votes
3 answers
15k views

Role-Based Access Control Disadvantages

According to NIST, RBAC models are the most widely used schemes among enterprises of 500 or more. What happens if the size of the enterprises are much larger in number of individuals involved. In ...
user avatar
  • 61
1 vote
0 answers
115 views

ABAC Policy Formal Presentation

I am asked to answer a question but i can't find such info in the internet so i created this post. The problem is: An on-line paper company decide to give access to their customers depend on their ...
user avatar
  • 11
3 votes
2 answers
3k views

Separation of Duties using RBAC

I'm reading an article about Role based Access Control, in section 6 (Separation of Duties) I didn't understand this part : Separation of duty can be either static or dynamic. Compliance with ...
user avatar
  • 133
3 votes
3 answers
561 views

Implement RBAC for my application

I'm beginning to work on a new web app for which I require implementing Role-Based Access Control. I've identified three Roles for my application which will be Role 1, Role 2 and an Role 3. Each user ...
user avatar
-1 votes
2 answers
570 views

RBAC togehter with AAA?

I'm taking a network course and my teacher has not been answering my emails. I'm supposed to set up "Role based access using privileges with AAA" I thought RBAC and AAA stood in contrast to one and ...
user avatar
3 votes
1 answer
232 views

What are the security implications of having a dummy user account representing unauthenticated users?

In my web application, users are assigned to groups and groups are granted permissions on objects. The application exposes some objects to unauthenticated public users (i.e. people casually visiting ...
user avatar
  • 605
2 votes
1 answer
849 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
user avatar
  • 23
2 votes
2 answers
191 views

If authenticated user tries to access a restricted resource

If a user with authorization to access Resource A, tries to access Resource B (by trying to follow a URL), which of the following is a better course? Take them to a standard Access Denied Page, with ...
user avatar
  • 133
0 votes
1 answer
370 views

Securing Java REST Api for Saas usecase

I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring). I had a look at ...
user avatar
2 votes
1 answer
112 views

Explain the concept of RBAC to limit the right of senior staff

If a senior staff got authority to makes changes in the financial records of an organization so can take the money out from the organization which is operated by junior staffs. can RBAC be implemented ...
user avatar
2 votes
0 answers
2k views

How do i find the number of relationships between user and permission in DAC and RBAC

This is a part of a homework. I don't want an answer, just a hint. Assume a system with N job positions. For job position i, the number of individual users in that position Ui, and the number of ...
user avatar
2 votes
0 answers
74 views

Unique assignment of permissions to objects seems to also require the role?

So my understanding of RBAC is that Users have Roles, and Roles have Permissions and there should be a Permission Object mapping. I'm having a bit of a business logic problem though concerning RBAC. ...
user avatar
1 vote
1 answer
132 views

Automated tools for applying formal methods to verify security policy in existing software

I am new to the Formal Methods arena, but I feel I have an educated grasp on its applications. However, I only seem to encounter formal methods as applied to the development process, as the software ...
user avatar
6 votes
4 answers
5k views

encryption vs access control comparison

I have a very basic and simple question about two security concepts. Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
user avatar
  • 161
18 votes
2 answers
71k views

MAC vs DAC vs RBAC

Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
user avatar
  • 643
4 votes
5 answers
1k views

Can someone please explain RBAC to me?

From http://msdn.microsoft.com/en-us/library/jj709705.aspx In contrast to the DAC model, which is oriented around objects, the AzMan RBAC model attempts to orient the common administrative experience ...
user avatar
  • 307
1 vote
1 answer
280 views

ACL managed with roles

I have resources in an application. Further I have a table holding all resources and for every resource what role is allowed to access it. I also have defined a Table holding all uses that are ...
user avatar
8 votes
1 answer
11k views

What is the difference between claims, attributes, and roles?

Many questions have already been asked about Claims-based authentication and the differences with other approaches: Role-based vs Claims-based Explain claims-based authentication Now, my favorite ...
user avatar
  • 5,363
2 votes
2 answers
351 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if (hasAssertion(...
user avatar
  • 121
0 votes
3 answers
790 views

role based access control - same role, different departments

This question about RBAC implementation. Can a subject have a role in a certain realm? Suppose a university is made up of departments. Departments have courses. Courses have students. Students have ...
user avatar
9 votes
1 answer
2k views

What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?

In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
user avatar
  • 101
40 votes
2 answers
24k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
user avatar
  • 2,449
4 votes
4 answers
305 views

How can an Subject only read and write to its owned objects?

It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
user avatar
25 votes
4 answers
8k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to data ownership? For example: Bob is a doctor and has the role ...
user avatar
  • 7,362
13 votes
2 answers
3k views

Best practices for implementation of role-based access control in healthcare applications

Amongst the open source EMRs, which ones may be good to learn from? Any references I can go to as a starting point?
user avatar
  • 243
6 votes
1 answer
3k views

Is it correct to consider Task Based Access Control as a type of RBAC?

I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture: "Role Based Access Control doesn't always ...
user avatar
  • 3,296