RBAC model

Presentation

RBAC stands for Role Based Access Control. It means that you manage authorizations to access applications by checking the role(s) of the user, and provide this role to the application.

LemonLDAP::NG allows to use this model. You should use an extended LDAP schema (or any users database extension), but this can works with standard attributes.

Configuration

Roles as simple values of a user attribute

Imagine you've set your directory schema to store roles as values of ssoRoles, an attribute of the user. This is simple because you can send the role to the application by creating a HTTP header (for example Auth-Role) with the concatenated values (';' is the concatenation string):

Auth-Roles => $ssoRoles

If the user has these values inside its entry:

ssoRoles: user
ssoRoles: admin

Then you got this value inside the Auth-Roles header:

user; admin

Roles as entries in the directory

Now imagine the following DIT:

Roles are entries, below branches representing applications. Each user has a ssoRoles attributes, which values are the DN of the corresponding roles. With this organization, you can set roles to user within specific application.

In the schema above, the user has the following values:

ssoRoles: ou=admin,ou=aaa,ou=roles,dc=acme,dc=com
ssoRoles: ou=user,ou=bbb,ou=roles,dc=acme,dc=com

So he is “user” on application “BBB” and “admin” on application “AAA”.

Now we have to send the right role to the right application trough LemonLDAP::NG.

First step: create a rule to grant access only if the user has a role in the application:

For application AAA:

default => $ssoRoles =~ /ou=aaa,ou=roles/

For application BBB:

default => $ssoRoles =~ /ou=bbb,ou=roles/

Second step: get the role name for the application. We will use the macros to do that. Create two macros (inside Variables » Macros):

For application AAA:

aaaRole => ((grep{/ou=aaa/} split(';',$ssoRoles))[0] =~ /ou=(.*),ou=aaa/)[0]

For application BBB:

bbbRole => ((grep{/ou=bbb/} split(';',$ssoRoles))[0] =~ /ou=(.*),ou=bbb/)[0]

These regular expressions read the 'ou' value of the DN of the role of the concerned application. This works if the user has only one role per application.

Third step: provide the role to the application. It is done by creating the correct HTTP header:

For application AAA:

Auth-Roles => $aaaRoles

For application BBB:

Auth-Roles => $bbbRoles

Now the protected application can read in the header HTTP_AUTH_ROLES the role of the user.

If you have more than one role for an application, you can join those roles with a separator (ex: ||):

aaaRole => join(' || ', (map {/uid=(.*),ou=aaa.*/} (grep{/ou=aaa/} split(';',$ssoRoles)))