Skip to main content

​
What is Role-Based Access Control?

Role-Based Access Control (RBAC) is a way to secure and protect your organization’s resources and data from security breaches and unauthorized access. Roles assigned to users control the amount of access they have and limit what they’re allowed to do. Roles can be designated by a job function or capacity by assigning the least amount of access required for a user to complete their task. This design ensures that no user is given access to more resources or actions that what they are required to have, ensuring your tenant resources are safe and protected. Resources can only be accessed by an authorized user with the correct role for that specific resource. RBAC implements the basic flow for access control:
  • Role Assignment: Users are assigned roles with relevant permission(s) that govern access and actions allowed by the user.
  • Role Authorization:Users are authorized within their role before they invoke an API call or complete a task. Users can only use roles for which they are authorized.
  • Role Permissions and Access: Authorized users can access the requested resource and perform specific actions as defined by the associated permissions within the assigned role.
A relying party (RP) inspects the role(s) and/or permissions to determine what resources and actions the user can undertake. Digital Identity Management roles determine the type of access a user has and the permissions control what actions they can perform on that specific resource. By using a roles-based hierarchy, your organization can implement a system wide security policy to ensure authorized users access only the resources they require. Roles and permission assignments help minimize access issues, protects data and exchange of information, and prevents unauthorized use of your tenant resources and services.

​
Benefits of RBAC

RBAC provides a wide range of security protocols and guarantees that no one is going where they shouldn’t. The benefits include:
  • PCI Compliance: Improved data protection and robust data privacy controls that allow organizations to adhere to industry standards such as GDPR or HIPPA.
  • Security: Resource and data access is controlled and monitored. RBAC supports audit trails and records the access history of resources.
  • Granular Access: Users are only granted access to a resource dependent on the role they possess. Additionally, multiple roles can be assigned to users with a permission set specifying what the user can do.
  • Reduce Administration: Roles and permission assignments can be dynamically updated and are globally applied to your whole tenant. Once a role is updated and saved, changes propagate across all the groups, users, and applications without any more manual configuration from you.
  • Flexible and Scalable: As organization changes, so do the requirements. Roles and permissions can be modified dynamically as future needs evolve, while still maintaining backwards compatibility with previous configurations.

​
Permissions and Roles

Permissions define what the user’s level of access to a resource is and what they’re allowed to do on that resource. A permission is assigned to a role, and a role is assigned to a user, and grants them a specific level of access to a resource. A role can have more than one permission. Essentially, a role is a collection of permissions and users are assigned roles that contain those associated permissions A role can exist without any assigned permissions or alternatively, contain one or more permissions. Roles are encoded in the access token and permissions are also encoded in the access token, if they’re assigned to a role. If the a role has no permissions, the role doesn’t allow the user see or use any resource. In other words, a permission needs to be assigned to a role to define the level of access and type of actions that are available to perform on a resource. Essentially, the collection of permissions that are associated or assigned to a role define the user’s capability. Users granted a role, inherit the permissions associated with that role to define their access level to the requested resource.

​
RBAC Administration

Permission management Digital Identity Management provides a set of APIs to perform CRUD operations and the ability to assign permissions to a role. The user needs Assignment Manager or Super Admin role to perform the following tasks:
  • Create a new permission and assign to an existing role.
  • View existing permissions.
  • Update a permission.
  • Delete a permission.
Role Management Digital Identity Management provides a set of APIs to perform CRUD operations on roles and the ability to assign permissions to roles. A Role can exist with or without permissions. The user needs Assignment Manager or Super Admin perform the following tasks:
  • Create a new role and assign permissions to it.
  • View existing roles and associated permissions.
  • Update a role.
  • Delete a role. Note: If a role is deleted, any user with that role needs to have it removed from their profile. The user is not deleted.
User Role Management Digital Identity Management provides a set of APIs that allow you to view users and manage role assignments. You can view and mange specific user roles to complete the following tasks:
  • View all users.
  • View a specific user.
  • Assign a role to a user.
  • Remove a role from a user.
Parent topic:Digital Identity Management Features