Problem solve Get help with specific problems with your technologies, process and projects.

How do role-based access control methods authorize user accounts?

In this expert Q&A, Joel Dubin demonstrates how to authorize groups using role-based access control (RBAC).

What is role-based access control?

Role-based access control, or RBAC, is an access-control method that places a user into a group sharing identical access levels to a system. With RBAC, the user already has an individual account on the system, but is also added to a group that has access to the same resources.

RBAC relates more to authorization rather than authentication. Authentication verifies the user's account on the system, usually with an identity credential, like a user ID and password. Authorization verifies what data the user is allowed to access after being authenticated.

If a user is authenticated and has access to the system, it doesn't necessarily mean that he or she has access to everything on it.

Groups are assigned based on the security needs of a business or organization. There is no cookie-cutter approach to RBAC. It has to be tailor-made for each system, but that's not necessarily a bad thing. You wouldn't want your marketing staff, for example, to have access to payroll information that should only be visible to, say, human resources. Nor would you want human resources to know about upcoming marketing promotions that should be kept under wraps. With RBAC, everyone, including human resources and marketing, would have their own individual accounts, but their accounts would be part of their respective groups.

When lumping accounts for RBAC, both Active Directory in Windows and LDAP in Unix can be used to create groups.

More on this topic


This was last published in December 2006

Dig Deeper on Web authentication and access control

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.