# Modèle RBAC

## Présentation

RBAC signifie contrôle d'accès basé sur les rôles (Role Based Access Control). Celà signifie qu'on gère les autorisations d'accès aux applications en examinant le(s) rôle(s) de l'utilisateur et en fournissant ce(s) rôle(s) à l'application.

As the definition of access rules is free in LemonLDAP::NG, you can implement an RBAC model if you need.

## Configuration

### Rôles comme simple valeur d'attribut utilisateur

Imagine you've set your directory schema to store roles as values of an attribute of the user, for example “description”. This is simple because you can send the role to the application by creating a HTTP header (for example Auth-Role) with the concatenated values (';' is the concatenation string):

    Auth-Roles => $description

Si l'utilisateur dispose de ces valeurs dans son entrée :

    description: user
    description: admin

On les obtient dans l'en-tête Auth-Roles :

    user; admin

### Rôles comme entrée d'annuaire

On suppose le schéma suivant :

- dc=example,dc=com
  - ou=users
    - uid=coudot
  - ou=roles
    - ou=aaa
      - cn=admin
      - cn=user
    - ou=bbb
      - cn=admin
      - cn=user

Les rôles sont des entrées, les branches subordonnées représentant les applications. We can use the standard LDAP objectClass `organizationalRole` to maintain roles, for example:

    dn: cn=admin,ou=aaa,ou=roles,dc=example,dc=com
    objectClass: organizationalRole
    objectClass: top
    cn: admin
    ou: aaa
    roleOccupant: uid=coudot,ou=users,dc=example,dc=com

A user is attached to a role if its DN is in `roleOccupant` attribute. We add the attribute `ou` to allow LL::NG to know which application is concerned by this role.

So imagine the user coudot is “user” on application “BBB” and “admin” on application “AAA”.

#### Gather roles in session

Use the LDAP group configuration to store roles as groups in the user session:

- Base: ou=roles,dc=example,dc=com
- Object class: organizationalRole
- Target attribute: roleOccupant
- Searched attributes: cn ou

#### Restrict access to application

We configure LL::NG to authorize people on an application only if they have a role on it. For this, we use the `$hGroups` variable.

- Pour l'application AAA :

    default => groupMatch($hGroups, 'ou', 'aaa')

- Pour l'application BBB :

    default => groupMatch($hGroups, 'ou', 'bbb')

#### Send role to application

It is done by creating the correct HTTP header:

- Pour l'application AAA :

    Auth-Roles => ((grep{/aaa/} split(';',$groups))[0] =~ /([a-zA-Z]+?)/)[0]

- Pour l'application BBB :

    Auth-Roles => ((grep{/bbb/} split(';',$groups))[0] =~ /([a-zA-Z]+?)/)[0]