RBAC Configuration

IMPORTANT

Role-Based Access Control (RBAC) and Authentication features are handled by a separate, external service. The implementation details here represent how ScriptBee interacts with that service.

ScriptBee uses OPA (Open Policy Agent) for RBAC and authentication, determining their roles and permissions.

See Authentication for more information on how to configure the authentication and authorization service.

See Architecture Diagram to understand the interaction between ScriptBee and the authentication and authorization service.

An example of the default rules can be found in the OPA rules file.

The following sections describe the roles and permissions that are used in ScriptBee. The roles can be defined in the OPA server and assigned to users. The permissions are used to determine what actions a user can perform in ScriptBee.

Authorization Contracts

ScriptBee uses the following authorization contracts to determine what actions a user can perform.

External Authorization Url

See ExternalAuthorizationUrl Config for more details

Request

POST request with body example:

{
  "input": {
    "subject": {
      "user_id": "user-123",
      "groups": ["admins"]
    },
    "action": "project:view",
    "resource": {
      "type": "project",
      "id": "project-123",
      "role": "Administrator"
    }
  }
}

Or

{
  "input": {
    "subject": {
      "user_id": "user-123",
      "groups": ["admins"]
    },
    "action": "gateway_plugin:management",
    "resource": {
      "type": "global"
    }
  }
}

The possible values for the action field are defined in the Permissions section.

The possible values for the resource.type are:

• global
• project

Response

The response is expected to be in the format:

{
  "result": true
}

Permissions Url

See PermissionsUrl Config for more details

Request

POST request with body example:

{
  "input": {
    "subject": {
      "user_id": "user-123",
      "groups": []
    },
    "resource": {
      "type": "project",
      "id": "project-123",
      "role": "Editor"
    }
  }
}

Response

The response is expected to be in the format:

{
  "result": ["project:view", "project:edit", "project:delete"]
}

Roles Url

See RolesUrl Config for more details

Request

A GET request

Response

The response is expected to be in the format:

{
  "result": [
    {
      "id": "Editor",
      "description": "User that can manage projects they belong to."
    },
    {
      "id": "Analyst",
      "description": "User that can perform analysis tasks on allowed projects."
    },
    {
      "id": "Viewer",
      "description": "User that can view only allowed projects and their analysis."
    }
  ]
}

Default Creator Role Url

Request

See DefaultCreatorRoleUrl Config for more details

A GET request

Response

The response is expected to be in the format:

{
  "result": "Editor"
}

Roles

Detailed here are the possible roles a user can have in ScriptBee.

• Admin - user that can perform any action
• Editor - user that can perform project management on project they belong to
• Analyst - user that can perform different analysis tasks on allowed projects
• Viewer - user that can view the results of the analysis

Note: The roles are only as examples, and can be defined in the OPA server. The roles can be assigned to users in the OPA server. The permissions are the ones that are actually used in ScriptBee to determine what actions a user can perform. The roles can be defined in the OPA server and assigned to users. The permissions are used to determine what actions a user can perform in ScriptBee.

Project Level Permissions

Project

Permission	Admin	Editor	Analyst	Viewer
project:view_all	✓
project:view	✓	✓	✓	✓
project:live_updates	✓	✓	✓	✓
project:edit	✓	✓
project:delete	✓	✓
project:manage_access	✓	✓

Scripts

Permission	Admin	Editor	Analyst	Viewer
script:view	✓	✓	✓	✓
script:create	✓	✓
script:edit	✓	✓
script:delete	✓	✓

Model

Permission	Admin	Editor	Analyst	Viewer
model:view	✓	✓	✓
model:upload	✓	✓	✓
model:load	✓	✓	✓
model:link	✓	✓	✓
model:clear	✓	✓	✓

Instance

Permission	Admin	Editor	Analyst	Viewer
instance:view	✓	✓	✓
instance:allocate	✓	✓	✓
instance:deallocate	✓	✓	✓

Analysis

Permission	Admin	Editor	Analyst	Viewer
analysis:view	✓	✓	✓	✓
analysis:run	✓	✓	✓
analysis:delete	✓	✓

Plugins

Permission	Admin	Editor	Analyst	Viewer
plugin:view	✓	✓	✓
plugin:install	✓	✓
plugin:uninstall	✓	✓
plugin:configure	✓	✓
gateway_plugin:management	✓

Token management

Permission	Admin	Editor	Analyst	Viewer
token:create	✓	✓
token:delete	✓	✓

Global Level Permissions

Permission	Admin	Regular User
project:create	✓	✓
gateway_plugin:management	✓