<ahref="http://en.wikipedia.org/wiki/Role-based_access_control"class="urlextern"title="http://en.wikipedia.org/wiki/Role-based_access_control"rel="nofollow">RBAC</a> stands for Role Based Access Control. It means that you manage authorizations to access applications by checking the role(s) of the user, and provide this role to the application.
Imagine you've set your directory schema to store roles as values of an attribute of the user, for example “description”. This is simple because you can send the role to the application by creating a HTTP header (for example Auth-Role) with the concatenated values (';' is the concatenation string):
Roles are entries, below branches representing applications. We can use the standard LDAP objectClass <code>organizationalRole</code> to maintain roles, for example:
A user is attached to a role if its <abbrtitle="Distinguished Name">DN</abbr> is in <code>roleOccupant</code> attribute. We add the attribute <code>ou</code> to allow <abbrtitle="LemonLDAP::NG">LL::NG</abbr> to know which application is concerned by this role.
So imagine the user coudot is “user” on application “BBB” and “admin” on application “<abbrtitle="Authentication Authorization Accounting">AAA</abbr>”.
Use the <ahref="../../documentation/1.9/authldap.html#groups"class="wikilink1"title="documentation:1.9:authldap">LDAP group</a> configuration to store roles as groups in the user session:
We configure <abbrtitle="LemonLDAP::NG">LL::NG</abbr> to authorize people on an application only if they have a role on it. For this, we use the <code>$hGroups</code> variable.
