RBAC und ABAC

Einfach erklärt

RBAC und ABAC steuern, wer auf was zugreifen darf.

RBAC (Role-Based):
User → Role → Permissions
├── Alice → Admin → [read, write, delete]
├── Bob → Editor → [read, write]
└── Carol → Viewer → [read]

ABAC (Attribute-Based):
IF user.department == "Finance"
   AND resource.type == "Report"
   AND time.hour BETWEEN 9 AND 17
   AND user.device == "Corporate"
THEN allow

Technischer Deep Dive

RBAC Implementation

class RBAC:
    def __init__(self):
        self.roles = {
            "admin": ["read", "write", "delete", "admin"],
            "editor": ["read", "write"],
            "viewer": ["read"]
        }
        self.user_roles = {}
    
    def assign_role(self, user_id, role):
        self.user_roles[user_id] = role
    
    def has_permission(self, user_id, permission):
        role = self.user_roles.get(user_id)
        return permission in self.roles.get(role, [])

ABAC mit OPA

# policy.rego
package authz

default allow = false

allow {
    input.user.role == "admin"
}

allow {
    input.user.department == input.resource.department
    input.action == "read"
}