Set Up RBAC (Role-Based Access Control)
Implement a complete role-based access control framework from scratch - defining roles, assigning permissions, and establishing access patterns.
RBAC Implementation Roadmap
Phase 1: Plan Your Roles
Document needed roles:
- Admin roles (platform-admin, team-lead)
- Creator roles (pipeline-creator, dashboard-creator)
- Editor roles (data-editor, catalog-editor)
- Viewer roles (pipeline-viewer, data-viewer)
Phase 2: Get Available Permissions
Bash
GET /authz/api/v1/roles/template
Returns: All available permissions in ADOC
Phase 3: Create Roles
Bash
# Platform Admin (full access)
POST /authz/api/v1/roles
{
"name": "platform-admin",
"description": "Full platform administration",
"permissions": ["*"]
}
# Pipeline Creator (create & manage pipelines)
POST /authz/api/v1/roles
{
"name": "pipeline-creator",
"description": "Create and manage pipelines",
"permissions": [
"pipeline.create",
"pipeline.edit",
"pipeline.view",
"pipeline.execute"
]
}
# Data Viewer (read-only)
POST /authz/api/v1/roles
{
"name": "data-viewer",
"description": "View-only access to data",
"permissions": [
"pipeline.view",
"catalog.view",
"dashboard.view"
]
}
Phase 4: Assign Roles to Groups
Bash
# Data Engineering gets creator access
PUT /admin/api/assign-client-roles
{
"groupId": "group-data-eng",
"roles": ["pipeline-creator", "catalog-editor"]
}
# Analytics gets viewer access
PUT /admin/api/assign-client-roles
{
"groupId": "group-analytics",
"roles": ["data-viewer", "dashboard-creator"]
}
Phase 5: Test & Verify
Bash
# Test each role
GET /authz/api/v1/users/test-user/roles
GET /authz/api/v1/users/permissions?userId=test-user
# Verify users can access what they need
# Verify users cannot access what they shouldn't
APIs Used
- GET /authz/api/v1/roles/template - Available permissions
- POST /authz/api/v1/roles - Create roles
- GET /authz/api/v1/roles - List all roles
- PUT /admin/api/assign-client-roles - Assign to groups/users
- GET /authz/api/v1/users/:userId/roles - Verify assignments
No comments yet.