Role Based Access Control (RBAC)

Edit online

Overview of Role Based Access Control (RBAC) in Application Modernization Accelerator and how it works.

What is RBAC

Note: RBAC is available in Application Modernization Accelerator version 5.0.0 and later. This feature is not available in earlier versions.

Role Based Access Control (RBAC) is a widely-adopted security model that restricts system access based on a user's role within an organization rather than granting permissions to individual users. In RBAC, permissions are assigned to roles, and users are then assigned to those roles, inheriting the associated permissions. This approach follows the principle of least privilege, ensuring users have only the access necessary to perform their job functions.

RBAC provides several key benefits for organizations:
  • Simplified Management: Instead of managing permissions for each individual user, administrators assign users to predefined roles, making it easier to onboard new users and modify access as job responsibilities change
  • Enhanced Security: By limiting access based on roles, RBAC reduces the risk of unauthorized access and helps prevent security breaches
  • Scalability: As organizations grow, RBAC scales efficiently without requiring individual permission management for each new user
  • Compliance and Auditing: RBAC makes it easier to demonstrate compliance with regulatory requirements and provides clear audit trails of who has access to what resources

In Application Modernization Accelerator, RBAC is implemented by mapping OAuth2 groups to AMA roles and workspaces. This allows you to leverage your existing identity management infrastructure to control user access to Application Modernization Accelerator.

How RBAC works in AMA

Application Modernization Accelerator allows you to map OAuth2 groups to AMA roles and workspaces:

  • Any users that belong to mapped OAuth2 groups will receive the matching access
  • Any users that do not belong to any mapped OAuth2 groups will not be able to access any data in AMA

AMA Roles

In Application Modernization Accelerator there are 3 possible roles, each with more capabilities than the previous role:

  • Admin: Can assign roles and create and delete workspaces
  • Writer: Can modify the contents of any workspace and create groups and add tags
  • Reader: Can view data only
Figure 1. RBAC permissions for AMA
Review permissions assigned to each AMA role

Workspace Access

Additionally, OAuth2 groups can be mapped to specific workspaces and will not be able to see any workspace they are not mapped to.

Note: By default all users will have access to all workspaces until workspace access restrictions are enabled.

Mapping the initial Admin role

Once RBAC has been enabled, the next user to access the UI will be redirected to the RBAC access screen.

This user will be presented with a list of OAuth2 groups that they belong to and MUST select one of those groups to be mapped to the AMA admin role.

Important: This mapping cannot be deleted.

Mapping roles in AMA

The Admin user can map roles and workspaces in Application Modernization Accelerator:

  1. Choose the 'Roles and permissions' option in the left hand menu
  2. When creating a mapping, the user enters the OAuth2 group they want to map and they select the AMA role they want to map to
Note: The OAuth2 group text is not validated by AMA.
Note: The OAuth2 group can be defined using regex syntax. For example, an OAuth2 group defined as 'Dev*' will match to any OAuth2 group starting with 'Dev'.
Figure 2. Role-based access control in AMA
Mapping OAuth2 groups to AMA roles and granting workspace access

Mapping workspace access in AMA

When mapping a role in Application Modernization Accelerator there is an option to enable Workspace access:

  1. Toggle Workspace access on to enable this option
  2. Select the workspaces that you want this OAuth2 mapping to have access to
Figure 3. Enabling and mapping workspace access
Enabling and mapping workspace access for OAuth2 mapped role

Enabling audit tracking

Audit tracking can be enabled on Application Modernization Accelerator if RBAC has been enabled.

All Create, Delete and Update actions will be logged along with the user id and relevant information. This id can be resolved to the specific user by looking it up in the OAuth2 server.

Access to the audit log is limited to users with the Admin role and can be accessed via the swagger interface only.

Figure 4. Enable audit tracking
On enabling RBAC on AMA, audit tracking can be enabled.