Why?
RBAC lets you easily manage roles and permissions in any application and see at a glance exactly which permissions a person has in the system. It reduces complexity over traditional Access Control List (ACL) based permissions systems.
What?
The purpose of RBAC is to provide a framework for application administrators and developers to manage the permissions assigned to the people using the App(s).
Who?
Anyone who is interested in developing secure applications used by many people with differing needs and permissions should learn about RBAC.
How?
Installation
The package can be installed
by adding rbac to your list of dependencies in mix.exs:
def deps do
[
{:rbac, "~> 0.1.0"}
]
endTODO: update once published Documentation generated with ExDoc and published on HexDocs. Once published, the docs can be found at https://hexdocs.pm/rbac.
###
###
tl;dr > RBAC Knowledge Summary
Each role granted just enough flexibility and permissions to perform the tasks required for their job, this helps enforce the principal of least privilege
The RBAC methodology is based on a set of three principal rules that govern access to systems:
Role Assignment: Each transaction or operation can only be carried out if the person has assumed the appropriate role. An operation is defined as any action taken with respect to a system or network object that is protected by RBAC. Roles may be assigned by a separate party or selected by the person attempting to perform the action.
Role Authorization: The purpose of role authorization is to ensure that people can only assume a role for which they have been given the appropriate authorization. When a person assumes a role, they must do so with authorization from an administrator.
Transaction Authorization: An operation can only be completed if the person attempting to complete the transaction possesses the appropriate role.