I have to provide some functionality that will let me create users with a custom set of permissions by assigning them some combination of existing roles for couchbase.
For example I want to have role X that will be equal to those couchbase roles: query_select, fts_searcher and data_monitoring.
The problem is that I couldn't find way to conclude which roles will be inherited. This is only shown with browser API when you choose Admin or Cluster Admin role, but there are more of those cases.
When I'm creating those roles in Python SDK or using couchbase-cli there is like 0 verification on that, so then even Admin role does not exclude the ones it inherit (see u01).
There is some info in documentation that helps me deal with that but it doesn't cover all of it.
RBAC for Administrators and
RBAC for Applications
Is there any faster way than testing it out manually?
Any help would be greatly appreciated!
Related
we have a common APIM setup where developer publishes and subscribes products. Can we restrict certain developers to only publish APIs under specific product. We don't want a developer tampering with the product published by another developer. I found a document where we can restrict the visibility from a subscribers perspective link to doc
Can a similar access control can be done for a publishers?
Look into ARM custom roles: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles You should be able to create RBAC rules for your developers scoping access only to a certain products, since API membership in product is controlled by /products/{pid}/apis/{aid}
There is a concept called "groups" provided by azure, which will help us to group users and give privileges based on the roles(RBAC). Groups are further divided into two types
1.Default
2.Custom
A specific group of users can be given permissions edit to a specific product and only read some other product.
For Further reference follow the link: https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-create-groups
I'm about to develop a management web app with Laravel.
I need that my users have different roles with different permission.
In details: some users can add customers, some users can write pieces of a paper related to the customer, some other users can just read that paper and some other users can read just some pieces of that paper.
So I decided to use an RBAC approach in order to gain a certain flexibility.
I'll use this DB schema (just an example schema, but represent the needings of my application):
dbexample
My answer is: since there is a direct relationship between users and paper, customer, attachs etc., how are RBAC rules expressed? I have to check user's permission in frontend when he request an operation or a resource? Or there are ways to express this rules even at backend level? Maybe using some GRANT options?
Hope sby can help.
Thank you!
I would recommend using one of the RBAC packages already available to you, there are a few out there but a couple noteworthy mentions include:
Spatie Permissions
Laratrust
You define roles such as User and Customer, permissions such as can-write-paper, can-read-paper and assign them to either roles or individual users depending on your use case.
I'm beginner to yii2, I want to FOLLOW a suggermento Which way to create two users with different capabilities. Can you give me an example of how to create two types of users? Thanks so much
In yii2 for manage the proces for verifying that a user has enough permission to do somethingthere there are ACF and RBAC
ACF Access Control Filter is a simple authorization method implemented and is best used by applications that only need some simple access control.
RBAC Role-Based Access Control provides a powerful centralized access control yet simple to mnanage.
Yii implements a General Hierarchical RBAC, following the NIST RBAC model.
RBAC can be based on PHP files or directly on database table ..
you can find useful info in this guide http://www.yiiframework.com/doc-2.0/guide-security-authorization.html
Please folow yii2 starter kit for reference RBAC config. With feature RBAC with predefined guest, user, manager and administrator roles.
Yii2 starter kit
You can use user roles and give specific permissions to each of roles
Is it possible to make an integration between Alfresco and LDAP to manage groups, users and permissions?
I mean, alfresco groups must be managed with its own set of permissions? Currently I have a LDAP repository to allow authentication, but it is a lot of work to maintain users and groups across multiple systems.
In other words, can i make a full integration between these two environments easily and without modifying the core of alfresco?
Thanks in advance
Short answer is no.
IMHO, externally managed users, groups and authentication are already the maximum to make sense of. Even then, a part of authorities (users / groups) will still be created locally in alfreco when you start using share sites and invite external people. Sure, this could technically be changed, but alfresco writing to LDAP opens a new can of worms. The default LDAP read/sync approach should not cause sigificant extra efforts.
Authorization data, such als roles (which can easily be confused with groups) and permissions and their semantics are highly dependent on application (alfresco). It does not make sense to manage them in an external system that has no clue.
I am rolling my own blogging system and I am wondering how to determine permissions and implement them in a blogging system?
What should be the permissions for a commenter, a blogger and an admin?
What is the best way to implement them?
You didn't mention what language/framework you're using. Django includes a very useful and complete set of permissions that you can get up and running with. I'd assume that there are a number of other web frameworks that do the same.
Therefore, my advice is to find a web framework that you like and think is fun (this sounds like a personal project after all) that will handle these kinds of things for you.
I'd go with a combination of a decoupled authentication component, that you can ask if the current user has the role X, and if so allow them to do the thing. That way you can leave the specifics of groups and expiry etcetera to the authentication component.
You could combine this with some specialized authentication for your blogging engine, eg. having a list of posters in the blog object, and always allowing those persons to make posts.
Give each user a "privilege" value and store it in the users table in the database.
for example:
0: plain user (can comment)
1: writer (can write new posts and modify his own posts)
2: moderator (accepts/deletes comments)
4: admin (access to all)
Use a combination of serverside sessions and cookies for logins.
For "advanced" user privileges, use bitmasks and create groups.
Bitmasking: for example, using previous values, user level 3 (2+1) would have both writer and moderator privileges.