Role based access control, or RBAC 101

By Eric Rosenzweig

Role based access control, more commonly referred to as RBAC (r – back), is a functional enhancement to identity management solutions. I call it an enhancement because we're not reinventing the wheel with RBAC, just making identity management better, more efficient. The main components of an identity management solution are still present and used with RBAC, like user ID's, applications, and specific resource entitlements. It's just that RBAC introduces a new layer of structure and association between the ID's and the resource entitlements. The end result of that new layer is that the access requirements are easier to understand for everyone involved, from the business person who requests system access, to the manager who certifies that the access is appropriate, and to the tech support person who configures the access permissions.

So, what's this new layer introduced with RBAC? The roles! Almost every company is using some form of roles. It's just that they're probably not utilizing that information when they're managing identities and access rights. Generally, people are already grouped and identified within their companies by job titles/codes. For example, there could be account managers, account executives, sales managers, operations managers, payroll administrators, etc. The idea is that the users classified as payroll administrators should essentially be performing the same, or very similar, job tasks. Therefore, their system access requirements should also be the same.

Based off of that premise, using RBAC principles, a functional or business role would be created for the payroll administrator. The specific entitlements that a payroll administrator routinely uses would be grouped into Resource or IT roles based upon the system platform or application. This simplifies the access request for the new payroll administrator. Instead of that user having to know that they need x, y, and z from the HR system, a, b, and c from the IBM mainframe, and belong to 3 different Active Directory groups, all they have to do is request the "Payroll Administrator" role. That's it from the end user's perspective, easy. Behind the User Interface, the Payroll Administrator role is mapped to one or more Resource roles which have combined all of those fine grained entitlement details into easy to handle groupings. Provisioning of that access request can still be executed the way your current identity management solution handles it. Like I said, the components of your existing identity management solution are still needed, and can still be used.

In addition to the increased ease that RBAC provides to the end user selecting access, it also greatly simplifies access certification or governance. Your company should already be doing periodic reviews of user access to ensure that people have the access they need, not the access they've collected over the years or through job transfers. Unfortunately, the person or group responsible for that review, often times, is looking at highly technical entitlement descriptions. They don't understand what they are reviewing, especially if they are outside the technology department. Here's where using RBAC also tremendously helps that person out, by asking them to certify what they recognize and are qualified to review. They should be able to understand, and signoff on the fact, that John Doe is a Payroll Administrator and also a member of the Payroll Administrator functional role. Once again, that's it, no need for the reviewer to understand, or worse yet, blindly signoff on, what something like "boe_proll_p_read" means, anymore.

As you can see, the benefits of using RBAC within your organization are a much more efficient end user experience, greater consistency in the access that the users have, and the ability to quickly and accurately certify that the access your users have is correct. All of that adds up to less time wasted trying to get an employee the access needed to do their job and less risk of an employee having too much, or incorrect access.

How have you seen RBAC described or used? Have you found other major benefits to having RBAC used within your organization?

Eric Rosenzweig is a Consultantwith Solstice Consulting, based out of Chicago. Eric has over 7 years of experience delivering IT solutions. He specializes in information security, identity management, and RBAC.