text: (self.webpackChunkdocusaurus_template=self.webpackChunkdocusaurus_template||[]).push([[2002],{3905:function(e,t,n){"use strict";n.d(t,{Zo:function(){return p},kt:function(){return d}});var r=n(67294);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function i(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=r.createContext({}),c=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},p=function(e){var t=c(e.components);return r.createElement(l.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},m=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,l=e.parentName,p=i(e,["components","mdxType","originalType","parentName"]),m=c(n),d=o,f=m["".concat(l,".").concat(d)]||m[d]||u[d]||a;return n?r.createElement(f,s(s({ref:t},p),{},{components:n})):r.createElement(f,s({ref:t},p))}));function d(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,s=new Array(a);s[0]=m;var i={};for(var l in t)hasOwnProperty.call(t,l)&&(i[l]=t[l]);i.originalType=e,i.mdxType="string"==typeof e?e:o,s[1]=i;for(var c=2;c<a;c++)s[c]=n[c];return r.createElement.apply(null,s)}return r.createElement.apply(null,n)}m.displayName="MDXCreateElement"},26667:function(e,t,n){"use strict";n.r(t),n.d(t,{frontMatter:function(){return s},metadata:function(){return i},toc:function(){return l},default:function(){return p}});var r=n(22122),o=n(19756),a=(n(67294),n(3905)),s={id:"rbac",title:"Role Based Access Control (RBAC)"},i={unversionedId:"engines/rbac",id:"version-v0.5/engines/rbac",isDocsHomePage:!1,title:"Role Based Access Control (RBAC)",description:"Role Based Access Control (RBAC)",source:"@site/versioned_docs/version-v0.5/engines/rbac.md",sourceDirName:"engines",slug:"/engines/rbac",permalink:"/keto/docs/v0.5/engines/rbac",editUrl:"https://github.com/ory/keto/edit/master/docs/versioned_docs/version-v0.5/engines/rbac.md",version:"v0.5",lastUpdatedBy:"aeneasr",lastUpdatedAt:1596805315,formattedLastUpdatedAt:"8/7/2020",frontMatter:{id:"rbac",title:"Role Based Access Control (RBAC)"},sidebar:"version-v0.5/docs",previous:{title:"Access Control Lists (ACL)",permalink:"/keto/docs/v0.5/engines/acl"},next:{title:"ORY Access Control Policies",permalink:"/keto/docs/v0.5/engines/acp-ory"}},l=[],c={toc:l};function p(e){var t=e.components,s=(0,o.Z)(e,["components"]);return(0,a.kt)("wrapper",(0,r.Z)({},c,s,{components:t,mdxType:"MDXLayout"}),(0,a.kt)("p",null,(0,a.kt)("a",{parentName:"p",href:"https://en.wikipedia.org/wiki/Role-based_access_control"},"Role Based Access Control (RBAC)"),'\nmaps subjects to roles and roles to permissions. The goal of (H)RBAC is to make\npermission management convenient by grouping subjects in roles and assigning\npermissions roles. This type of access control is common in web applications\nwhere one often encounters roles such as "administrator", "moderator", and so\non.'),(0,a.kt)("p",null,"In ",(0,a.kt)("strong",{parentName:"p"},"Hierarchical Role Based Access Control (HRBAC)"),' roles can inherit\npermissions from other roles. The "administrator" role, for example, could\ninherit all permissions from the "moderator" role. This reduces duplication and\nmanagement complexity around defining privileges.'),(0,a.kt)("p",null,'Let\'s come back to Alice, Bob, Peter, and blog posts and the matrix from the ACL\nexample. This time we model the access rights using (H)RBAC and the roles\n"reader", "author", and "admin":'),(0,a.kt)("p",null,(0,a.kt)("img",{alt:"(H)RBAC Example",src:n(86633).Z})),(0,a.kt)("p",null,(0,a.kt)("inlineCode",{parentName:"p"},"Admin")," inherits all privileges from ",(0,a.kt)("inlineCode",{parentName:"p"},"author"),", which inherits from ",(0,a.kt)("inlineCode",{parentName:"p"},"reader"),".\nOnly ",(0,a.kt)("inlineCode",{parentName:"p"},"Alice")," (or rather her role ",(0,a.kt)("inlineCode",{parentName:"p"},"admin"),") can delete blog posts, whereas\n",(0,a.kt)("inlineCode",{parentName:"p"},"author")," can create and modify blog posts."),(0,a.kt)("p",null,"(H)RBAC is everywhere. If you ever installed a forum software such as\n",(0,a.kt)("a",{parentName:"p",href:"https://www.phpbb.com/support/docs/en/3.1/ug/adminguide/permissions_roles/"},"phpBB"),"\nor ",(0,a.kt)("a",{parentName:"p",href:"https://codex.wordpress.org/Roles_and_Capabilities"},"Wordpress"),", you have\ndefinitely encountered ACL, (H)RBAC, or both."),(0,a.kt)("p",null,"(H)RBAC reduces management complexity & overhead with large user/subject bases.\nSometimes however, even (H)RBAC is not enough. An example is when you need to\nexpress ownership (e.g. ",(0,a.kt)("inlineCode",{parentName:"p"},"bob")," can only modify his own blog posts), have\nattributes (e.g. ",(0,a.kt)("inlineCode",{parentName:"p"},"bob")," works in department ",(0,a.kt)("inlineCode",{parentName:"p"},"blog"),"), or in multi-tenant\nenvironments."),(0,a.kt)("p",null,(0,a.kt)("strong",{parentName:"p"},"Benefits:")),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},"Reduces management complexity when many identities share similar permissions."),(0,a.kt)("li",{parentName:"ul"},"Role hierarchies can reduce redundancy even further."),(0,a.kt)("li",{parentName:"ul"},"Is well established and easily understood by many developers as it is a\nde-facto standard for web applications.")),(0,a.kt)("p",null,(0,a.kt)("strong",{parentName:"p"},"Shortcomings:")),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},"Has no concept of context:",(0,a.kt)("ul",{parentName:"li"},(0,a.kt)("li",{parentName:"ul"},"There is no concept of ownership: ",(0,a.kt)("em",{parentName:"li"},'Dan is the author of article "Hello\nWorld" and is thus allowed to update it'),"."),(0,a.kt)("li",{parentName:"ul"},"There is no concept of environment: ",(0,a.kt)("em",{parentName:"li"},"Dan is allowed to access accounting\nservices when the request comes from IP 10.0.0.3"),"."),(0,a.kt)("li",{parentName:"ul"},"There is no concept of tenants: ",(0,a.kt)("em",{parentName:"li"},'Dan is allowed to access resources on the\n"dan\'s test" tenant'),".")))),(0,a.kt)("p",null,(0,a.kt)("strong",{parentName:"p"},"Implementation status:")," (Hierarchical) Role Based Access Control is currently\nnot implemented but will be first-class citizens in the future. To bump this in\npriority, please upvote\n",(0,a.kt)("a",{parentName:"p",href:"https://github.com/ory/keto/issues/60"},"this GitHub ticket"),"."))}p.isMDXComponent=!0},86633:function(e,t,n){"use strict";t.Z=n.p+"assets/images/rbac-c92e14595b7a1f13c2e6bea6edb68673.png"}}]);