Role Based Access Control Puns

We're working on the next major release of Oso, a new set of features in the library to speed up the time it takes to build fine-grained permissions using role-based access control (RBAC).

Here's a little sneak preview of the declarative roles configuration we've been actively developing! This configuration alone is enough to get you started on an RBAC implementation sufficient for pretty much any B2B use case. If you are using SQLAlchemy and interested in authorization, get a spot in the early access program.

https://preview.redd.it/gadfbv1kxjv61.png?width=1614&format=png&auto=webp&s=180cac72dbc0fc1e2a34e6bdf1f8d619980b1df1

How best to handle RBAC in an environment where you have both contracts requiring CUI protection and contracts that don't. I want to create the necessary Roles, but don't want to make it overly complicated. So for example do you all typically develop roles by contracts and only allow users access to information in the contracts they are involved in and therefore have to create a role per contract or do you take a broader approach?

Many frameworks and libraries provide plug-ins for common authorization patterns like roles, but either don't provide enough of a model to be helpful or are so rigid that you need to migrate away from them down the line.

We just released a library that provides a configuration-based approach to adding role-based access control (RBAC) to your application. The new Oso Roles library, with support for Python + Flask, speeds up the time it takes to build fine-grained permissions using roles and related patterns. The library includes:

• Role configuration
• Data management
• Enforcement
• End-user configuration
• Last-mile customizations

The library is in early access. Here are relevant links:

Documentation showing how to how to use the library to add roles to a Flask app with GitClub, our best practice example app: http://docs.osohq.com/python/guides/new-roles.html

GitClub source code: https://github.com/osohq/gitclub-sqlalchemy-flask-react

Hi,

Struggling to find a guide online which explains what I need.

I'm looking to set up a generic role-based auth system but with one caveat, users should be able to switch between multiple organizations on the app.

E.g think about an accounting app, you could be using one app to handle the accounts for multiple businesses, so you'd switch between them provided you have the access. Each business would have it's own set of data and users.

Any help will be appreciated!

Hello SiaCoin community,

I had reached out to Taek about this previously and he seemed to concur the idea had some potential (or was interesting - I forget the verbiage) so I wanted to out the feelers out to the community on this.

I will preface this by saying I haven't reviewed the latest update to know if this capability has been added so please chime in if it has but I was curious if the ability to assign permissions using something akin to security groups has been put in place.

One of the prime benefits of leveraing security groups and access control lists (ACLs) on files is it allows greater scalability and manageability of permissions to files and folders.

For example, instead of granting or revoking access to a single user identity (Not sure if this would be done via public key, SkyID or other attributes currently) to multiple files / folders, the user may be added to a group ID (a role) which has been assigned the desired permission set which may be removed simply by revoking membership to the SkyGroup.

This would simplify the process of revocation of permissions. Rather than removing the explicit permissions, the user would be removed from the group ID and would also serve the benefit of minimizing permission creep.

Based on my understanding of Skynet, I recall that one method of assigning of permissions on nginx would be via SSH keys but this, of course, is less than ideal as a secure solution would be required for the transmission of keys.

This is why I think some native mechanism of group memberships would be an advantage as then we would be able to leverage Sia's existing cryptography.

Does this make sense and would it be feasible to be implemented using consensus data? Look forward to hearing others thoughts on the matter.

Thank you for your time and I look forward to seeing SiaCoin / Skynet continue to evolve / mature to be a potential enterprise solution for file sharing and much more!

Anyone found any good tools for helping maintain a RBAC design for active directory?

I've created an effective nested group design with Domain Local groups for resource permission and Domain Global groups to describe the company structure, which controls access to our remaining file shares, SharePoint online, SQL servers and internal access to our in-house apps.

It's was a lot of work up front but easy to maintain over the long run (if you understand it well)... I'm struggling with handing the maintenance of it off to the service desk as the standard AD tools haven't changed since windows 2000 and make visualising the complex nesting impossible.

What are you guys using?

I’m learning how to implement RBAC for specific routes/views and ACL for shared files, folders and other objects permissions.

Does anyone have experience with adding these to your flask apps? Packages, example apps, tutorials, anything would be helpful. NOTE: I do realize that a lot of this is database design as well, but I don’t want to reinvent the wheel on the python side if possible.

At first glance, flask-praetorian and flask-user seem like they standout. Does anyone have experience with these? Security issues?

My ultimate goal here is to add these as ‘enterprise-features’. So I’d also be happy to hear from anyone who’s gone down that road as well.

I noticed that in the design principle of component, it mentioned that role-based access control grants components the minimum set of capabilities they require. Can someone explain more about the role-based access control in fuchsia? Thanks in advance!

RBAC or we can say Role Based Access Control System is the network security system which allows data access to the users on the basis of their role profile. RBAC also reduces employee downtime due to access issues.

https://preview.redd.it/8d1a0x1ydzv51.jpg?width=600&format=pjpg&auto=webp&s=8fb18d4530bbf0c988a97da29869a16af63f41b4

Hi,

I've been reading a lot of tutorials regarding RBAC and what I'm trying to do is a little more advanced, I want each user to belong to a specific organization which has a specific set of permissions and then within each organization they have a specific role where it has an additional set of permissions. I'm currently using mongoDB + nodeJS and I was wondering how this would look in my database?

Many frameworks and libraries provide plug-ins for common authorization patterns like roles, but either don't provide enough of a model to be helpful or are so rigid that you need to migrate away from them down the line.

We just released a library that provides a configuration-based approach to adding role-based access control (RBAC) to your application. The new Oso Roles library, with support for Python + Flask, speeds up the time it takes to build fine-grained permissions using roles and related patterns. The library includes:

• Role configuration
• Data management
• Enforcement
• End-user configuration
• Last-mile customizations

The library is in early access. Here are relevant links:

Documentation showing how to how to use the library to add roles to a Flask app with GitClub, our best practice example app: http://docs.osohq.com/python/guides/new-roles.html

GitClub source code: https://github.com/osohq/gitclub-sqlalchemy-flask-react

We're working on the next major release of Oso, a new set of features in the library to speed up the time it takes to build fine-grained permissions using role-based access control (RBAC).

Here's a little sneak preview of the declarative roles configuration we've been actively developing! This configuration alone is enough to get you started on an RBAC implementation sufficient for pretty much any B2B use case. If you are using SQLAlchemy and interested in authorization, get a spot in the early access program.

https://preview.redd.it/f63sqybwwjv61.png?width=1614&format=png&auto=webp&s=6ebda3ee9c7d8546434ce18054f6929baffefe43