Questions tagged [rbac]
The rbac tag has no usage guidance.
10
questions
0
votes
1
answer
61
views
Role Based Access Control: Inline vs Centralized
I have a server with many methods that can be requested by a user (or other service). I want to implement a role based access control. I can think of 2 ways to do it.
Inline: Each method has ...
- 143
0
votes
1
answer
716
views
RBAC - using database vs hard coded
I need to implement RBAC in a project I'm working on, and I'm fairly new to the concept. I am trying to figure out the best way to implement it.
The most common approach seems to be to create roles ...
- 149
1
vote
2
answers
153
views
RBAC and domain specific roles
I have some doubts about RBAC which I cannot wrap my head around. So I would like to hear what you guys think.
Though I understand the concept of RBAC, I cannot figure out how to apply that to my ...
- 13
0
votes
0
answers
37
views
Attempting to Implement RBAC from ACL
I am trying to implement RBAC to a system but I endup creating an ACL instead due to my low understanding of this archtecture.
What I already have implemented:
Created User model.
Created Groups with ...
- 109
0
votes
0
answers
203
views
How do you do you implement roles on your API's using Azure AD Security groups?
I'm trying to figure out the best way to accomplish using Azure Active Directory Security groups to manage role assignments for an API. I'm trying to evaluate a few different options as well as poll ...
0
votes
1
answer
190
views
OWASP Broken Access Control by example: preventing user's from reading/writing data that isn't theirs
I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them.
A situation was just presented to me that ...
0
votes
1
answer
151
views
How to limit resource creation with RBAC permission?
The project I am working on is a SaaS application with multiple payment tiers. Each one has multiple limits for different actions. One example would be that a free user can only create 1 space, a ...
2
votes
3
answers
1k
views
Securing API for third party use
We have a set of microservices and would like to expose endpoints from a subset of these for third parties to use. To this end, we will build an API Gateway that acts as the access control mechanism ...
- 185
0
votes
0
answers
969
views
Single users database for many apps
I'm designing a database that holds the information for users of three diferentes apps that share the access to the data trough an API. For every user i'm storing credentials, profile and roles.
What ...
- 109
5
votes
1
answer
6k
views
Dealing with permissions for the list of resource
I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions.
Now I need to build a new service. ...
- 183