Set Up RBAC (Role-Based Access Control)

Implement a complete role-based access control framework from scratch - defining roles, assigning permissions, and establishing access patterns.

RBAC Implementation Roadmap

Phase 1: Plan Your Roles

Document needed roles:

Admin roles (platform-admin, team-lead)
Creator roles (pipeline-creator, dashboard-creator)
Editor roles (data-editor, catalog-editor)
Viewer roles (pipeline-viewer, data-viewer)

Phase 2: Get Available Permissions

GET /authz/api/v1/roles/template

Returns: All available permissions in ADOC

Phase 3: Create Roles

# Platform Admin (full access) POST /authz/api/v1/roles { "name": "platform-admin", "description": "Full platform administration", "permissions": ["*"] } # Pipeline Creator (create & manage pipelines) POST /authz/api/v1/roles { "name": "pipeline-creator", "description": "Create and manage pipelines", "permissions": [ "pipeline.create", "pipeline.edit", "pipeline.view", "pipeline.execute" ] } # Data Viewer (read-only) POST /authz/api/v1/roles { "name": "data-viewer", "description": "View-only access to data", "permissions": [ "pipeline.view", "catalog.view", "dashboard.view" ] }

Phase 4: Assign Roles to Groups

# Data Engineering gets creator access PUT /admin/api/assign-client-roles { "groupId": "group-data-eng", "roles": ["pipeline-creator", "catalog-editor"] } # Analytics gets viewer access PUT /admin/api/assign-client-roles { "groupId": "group-analytics", "roles": ["data-viewer", "dashboard-creator"] }

Phase 5: Test & Verify

# Test each role GET /authz/api/v1/users/test-user/roles GET /authz/api/v1/users/permissions?userId=test-user # Verify users can access what they need # Verify users cannot access what they shouldn't

APIs Used

GET /authz/api/v1/roles/template - Available permissions
POST /authz/api/v1/roles - Create roles
GET /authz/api/v1/roles - List all roles
PUT /admin/api/assign-client-roles - Assign to groups/users
GET /authz/api/v1/users/:userId/roles - Verify assignments

Last updated on

Was this page helpful?