Questions tagged [rbac]
Role Based Access Control is a method of access controls where principals get access to resources through membership of permitted roles.
58
questions
2
votes
1
answer
124
views
Why has the adoption of ABAC been so slow?
Given we use ABAC in portions of our security systems like the WAF to partially restrict traffic based on attributes like IP address/User Agent String. While they can be faked internally tagging can ...
- 370
0
votes
0
answers
16
views
Permission model for automated infrastructure provisioning
I am trying to secure automatic infrastructure provisioning but I am having a hard time designing a proper access policy that would not create a single point of failure (I tried and failed about a ...
- 101
0
votes
0
answers
29
views
RBAC for system to system access
An organisations has multiple service tiers. One of the services in a core tier exposes APIs to the tier above. The core tier services do RBAC, consequently an end customer token is required in order ...
- 121
1
vote
0
answers
83
views
Is it a good idea to combine DAC with RBAC in this way?
I am not an infosec professional, but I'm working on a project that requires designing and implementing a permission system for a customer. The system the customer proposes is as follows:
Users are ...
- 11
1
vote
0
answers
92
views
Attempting to Implement RBAC from ACL
I am trying to implement RBAC to a system but I endup creating an ACL instead due to my low understanding of this archtecture.
What I already have implemented:
Created User model.
Created Groups with ...
- 111
0
votes
1
answer
93
views
Should access control be managed from inside application?
I am a developer who's just starting to learn about authorization and authentication for web apps. I am bit unclear on the concept of managing access control to parts of the app, and where is the best ...
- 113
2
votes
2
answers
150
views
Is using EXECUTE AS impersonation for user authentication in a web application a good idea?
I wrote a web application that is using AD authentication (Windows) and has its own authorization module (RBAC-like). Back-end is Microsoft SQL Server.
A DBA on my team is not happy with us using a ...
- 21
0
votes
1
answer
84
views
Is it ok to send roles and permissions data to the browser in a RBAC system?
I have a backend with a simple RBAC implementation. We have a list of permissions, each permission is associated with a list of roles, each user is given one or more roles.
Is it ok to send this ...
- 101
2
votes
1
answer
214
views
How to implement MySQL query fo RBAC authorization with fine grained business restrictions in role?
When implementing an authorization system like RBAC/DAC, or XACML, or the AWS IAM authorization model, I see that I can't totally decouple business logic from authorization when there are fine-grained ...
- 121
1
vote
1
answer
114
views
Is it good or bad to use group in sudoers file instead of using aliases?
I have used user groups heavily while designing access control policies. I find user groups very convenient as it's very easy to implement with PAM.
Another reason I have organized the users with ...
- 1,126
5
votes
2
answers
747
views
How to design an Access Control system that is quick to implement and understand, yet maintainable and flexible enough?
We're currently redesigning our access control system for our SaaS startup (over the past two years it has grown alongside the business and decided to clean it up at this point). The access control ...
- 51
1
vote
0
answers
128
views
Designing distributed authentication/authorisation system
I'm trying to design a system that has the following elements:
the main backend REST API (currently one, probably multiple in the future)
front-channel client(s) -- JS-based single-page app(s)
back-...
- 119
5
votes
2
answers
3k
views
Microservices and RBAC using OIDC
I am currently working on migrating our users from an internal DB to an OIDC service (considering Cognito/Auth0/etc.), and I am trying to implement RBAC.
Our backend is basically a bunch of ...
- 171
4
votes
1
answer
5k
views
Handling User Permissions Between Front-end and Back-end
We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
- 171
3
votes
3
answers
417
views
RBAC: how to separately scope two resources that have a many-to-many relationship
I'm working on an application that needs access control. Basically, the problem I'm facing is this (heavily simplified):
The application has two main sections:
Files = File[]
Contacts = Contact[]
...
- 133
0
votes
1
answer
194
views
SSO authentication & authorization architecture/implemenation
We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
- 157
0
votes
1
answer
1k
views
Question about access control with RBAC and DAC
Here is the problem
A company has 1250 employees and the employees have been trained to
handle 4 job duties:
Clerks: 1200 of the employees have been approved to work as clerks. To
do ...
1
vote
1
answer
89
views
Share Document within user group
I would like to share documents within groups and make sure that the member of each group can only access the documents shared in his/her group.
Situation:
There are 5 participants (A, B, C, D). ...
- 173
3
votes
0
answers
190
views
How can an organization manage permissions in a centralized way?
Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application.
Is the only way to have centralized authentication but ...
- 251
1
vote
1
answer
266
views
Is It Possible to Implement Rule-Based Access Control on Amazon Web Services?
I've gone through a few security tutorials on AWS and noted that each tutorial focused on role-based access control only. Has anyone used rule-based access control on AWS? If so, could you point me ...
- 119
1
vote
0
answers
102
views
Access Control - RBAC 0 (Zero) - use case
In this image, in definition of RBAC0, for point 5, if we change the Union to Intersection, will happen and present a use case scenario for this.
- 11
0
votes
1
answer
917
views
Difference between Non-discretionary and Role-based Access control?
What's the difference between Non-discretionary access control and Role-based Access Control? In CISSP book both mentioned in the different paragraph as in different entity. But In some other place (...
- 1,126
2
votes
0
answers
620
views
Web app access control system design
I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC.
For the ...
- 161
13
votes
1
answer
1k
views
Separating "function" from "scope" in RBAC
I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
- 231
5
votes
4
answers
8k
views
Rights vs permissions vs privileges
I have to write a node module for handling role-based access control. Users are stored in database, there are user groups, and there are system assets or functionality that users and groups can be ...
- 165
7
votes
1
answer
5k
views
RBAC0 RBAC1 RBAC2 RBAC3 -- What do they mean?
I am familiar with the concept of role-based access control but have heard the terms RBAC0 etc. being thrown around. What do these really mean? I found this quote on a NIST website:
In 1996, Sandhu,...
- 1,540
1
vote
0
answers
885
views
How to implement RBAC on Ubuntu?
I'm looking for the best approach to implement RBAC for about 100 Ubuntu servers. Currently all users are created locally mostly via Chef and we have no user directory service. All users have access ...
1
vote
1
answer
1k
views
Authorization based on OASIS ABAC/RBAC/XACML approach
Is anybody aware of any open source .NET authorization solution based on OASIS ABAC/RBAC/XACML approach?
I have found some visible amount of Java based solutions but it seems .NET is completely out ...
- 113
8
votes
3
answers
16k
views
Role-Based Access Control Disadvantages
According to NIST, RBAC models are the most widely used schemes among enterprises of 500 or more. What happens if the size of the enterprises are much larger in number of individuals involved. In ...
- 81
1
vote
0
answers
121
views
ABAC Policy Formal Presentation
I am asked to answer a question but i can't find such info in the internet so i created this post. The problem is:
An on-line paper company decide to give access to their customers depend on their ...
- 11
3
votes
2
answers
4k
views
Separation of Duties using RBAC
I'm reading an article about Role based Access Control, in section 6 (Separation of Duties) I didn't understand this part :
Separation of duty can be either static or dynamic. Compliance with ...
- 133
3
votes
3
answers
579
views
Implement RBAC for my application
I'm beginning to work on a new web app for which I require implementing Role-Based Access Control.
I've identified three Roles for my application which will be Role 1, Role 2 and an Role 3. Each user ...
- 39
-1
votes
2
answers
726
views
RBAC togehter with AAA?
I'm taking a network course and my teacher has not been answering my emails.
I'm supposed to set up "Role based access using privileges with AAA" I thought RBAC and AAA stood in contrast to one and ...
- 1
3
votes
1
answer
323
views
What are the security implications of having a dummy user account representing unauthenticated users?
In my web application, users are assigned to groups and groups are granted permissions on objects. The application exposes some objects to unauthenticated public users (i.e. people casually visiting ...
- 625
2
votes
1
answer
871
views
ABAC policy formulation and RBAC question
I am asked to answer a question that says:
One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
- 23
2
votes
2
answers
215
views
If authenticated user tries to access a restricted resource
If a user with authorization to access Resource A, tries to access Resource B (by trying to follow a URL), which of the following is a better course?
Take them to a standard Access Denied Page, with ...
- 133
0
votes
1
answer
377
views
Securing Java REST Api for Saas usecase
I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring).
I had a look at ...
- 101
2
votes
1
answer
115
views
Explain the concept of RBAC to limit the right of senior staff
If a senior staff got authority to makes changes in the financial records of an organization so can take the money out from the organization which is operated by junior staffs. can RBAC be implemented ...
- 81
2
votes
0
answers
3k
views
How do i find the number of relationships between user and permission in DAC and RBAC
This is a part of a homework. I don't want an answer, just a hint.
Assume a system with N job positions. For job position i, the number of individual users in that position Ui, and the number of ...
- 81
2
votes
0
answers
78
views
Unique assignment of permissions to objects seems to also require the role?
So my understanding of RBAC is that Users have Roles, and Roles have Permissions and there should be a Permission Object mapping.
I'm having a bit of a business logic problem though concerning RBAC. ...
- 322
1
vote
1
answer
138
views
Automated tools for applying formal methods to verify security policy in existing software
I am new to the Formal Methods arena, but I feel I have an educated grasp on its applications. However, I only seem to encounter formal methods as applied to the development process, as the software ...
6
votes
4
answers
6k
views
encryption vs access control comparison
I have a very basic and simple question about two security concepts.
Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
- 161
18
votes
2
answers
75k
views
MAC vs DAC vs RBAC
Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
- 653
4
votes
5
answers
1k
views
Can someone please explain RBAC to me?
From http://msdn.microsoft.com/en-us/library/jj709705.aspx
In contrast to the DAC model, which is oriented around objects, the AzMan RBAC model attempts to orient the common administrative experience ...
- 307
1
vote
1
answer
285
views
ACL managed with roles
I have resources in an application. Further I have a table holding all resources and for every resource what role is allowed to access it.
I also have defined a Table holding all uses that are ...
- 11
8
votes
1
answer
12k
views
What is the difference between claims, attributes, and roles?
Many questions have already been asked about Claims-based authentication and the differences with other approaches:
Role-based vs Claims-based
Explain claims-based authentication
Now, my favorite ...
- 5,423
2
votes
2
answers
373
views
RBAC and assertions, which authorization flow is better?
I'd like to ask which authorization flow is considered better or standard.
First approach (has role AND assertion is valid):
if (!isGranted(roles, permission) {
return false;
}
if (hasAssertion(...
- 121
0
votes
3
answers
860
views
role based access control - same role, different departments
This question about RBAC implementation. Can a subject have a role in a certain realm?
Suppose a university is made up of departments.
Departments have courses.
Courses have students.
Students have ...
9
votes
1
answer
2k
views
What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?
In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
- 101
40
votes
2
answers
26k
views
Role Based Authorization vs. Claim Based Authorization
What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
