Role based access control to the AS7 management layer.
Core Concepts
When defining an RBAC model, the following conventions are useful:
- Subject = A person or automated agent
- Role = Job function or title which defines an authority level
- Permissions = An approval of a mode of access to a resource
- Action = An operation to execute on a resource
- Constraint: Predicate that makes the permission valid in the context of the system state
- Session = A mapping involving Subject, Role and/or Permissions
https://community.jboss.org/servlet/JiveServlet/downloadImage/102-47854-21-19854/450-285/PermissonModel.png
Generic Requirements
- Provide a usable (in terms of complexity), yet comprehensive base model
- Provide a set of out-of-the-box roles & permissons that reflect common authorization requirements
- Allow to customizations/extension of the default scheme (i.e custom permissions, permission granularity)
- Provide the management operations to retrieve session information (i.e. roles assigned, permissions granted, etc)
- Clearly distinguish security exceptions from other operation errors (i.e. custom response headers)
- Mappability with existing authorisation schemes (i.e. JON)
Specific Requirements
Provide an authorization scheme that distinguishes structural & behavioural permission:
- structural permissions: control access to resources (i.e. restrict visibility of server groups)
- behavioural permission: control execution on resources (i.e. lock down certain operations, distinguish read & read/write access)
Use cases
See RBACUsecases
Advanced Topics
- Context based access control: i.e. Taking the connection into consideratin
- Support for role hierarchies: i.e. structuring roles to reflect an organizations lines of authority and responsibility
- Role constraints: i.e. mutual exclusive roles
- RBAC to manage RBAC itself
structuring roles to re ect an organiza tion s lines of authority and resp onsibility
