Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is RBAC (Role-Based Access Control); how is it applied in TR7?
Short answer
RBAC (Role-Based Access Control) is the access control model in which permissions are given not to individual users but to roles, and the user gains permissions through the role the user is assigned to (NIST RBAC). People who do the same job are assigned to the same role; when the role's permissions change, the permissions of everyone in that role change together. In TR7, each management user is assigned a User Type in the Device Users form; each of the 14 roles (e.g. Admin, Read-only user, Monitor user, Traffic manager, Traffic user, WAF manager, GTM user, Certificate manager) determines which areas (network, Load Balancer, WAF, GTM, settings, users, certificates) the user will access and at which level (full permission, can modify, read-only), and menus the user has no permission for are not shown to the user (User Types). Some roles have the User vServices field, which limits the user to specific vServices, and the Backend Service Permission, Certificate Management and Certificate Selection fields, which turn on the additional permissions within the role one by one.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Settings → User Management → Device Users | User Type (default Admin in the Add form) | The user's role and access level |
| Same form | User vServices, Backend Service Permission, Certificate Management, Certificate Selection | Narrowing the vServices the role covers and turning on the additional permissions within the role; appear only in the roles that support these fields |
| Settings → User Management → Device Users → User Management Settings | Default User Type to Create (default Read-only user) | The role assigned to a user who logs in for the first time with LDAP, RADIUS or TACACS+ while Automatic User Creation is on |
| Settings → Device Management → Management Access | 2FA requiring user types | From which roles the second factor is requested |
| AGS-enabled vService → Flowchart | Decision Point + AGS Condition (Variable type: AGS User Groups) | Granting application users access based on group membership |
Roles and Scope Fields
| Role | Permission | Scope field |
|---|---|---|
| Admin | Full permission in all areas | - |
| Read-only user | Read-only in all areas | User vServices; if empty, there is no restriction |
| Monitor user | Read-only monitoring on the Load Balancer and WAF screens | User vServices; if empty, there is no restriction |
| Network manager / Network user | Full permission / can modify in the network | Network user: network scope selection |
| Traffic manager | Full permission in the Load Balancer and in vService certificates; while Certificate management is on, full permission in certificate management as well | Certificate management |
| Traffic user | Can modify in the Load Balancer | User vServices, Backend Service Permission, Certificate selection |
| WAF manager / WAF read-only / WAF user | Full permission / read-only / can modify in WAF | WAF user: User vServices |
| Traffic+WAF manager | Full permission in the Load Balancer, WAF and vService certificates; while Certificate management is on, full permission in certificate management as well | Certificate management |
| Traffic+WAF user | Can modify in the Load Balancer and WAF | User vServices, Backend Service Permission, Certificate selection |
| Certificate manager | Full permission in certificates | - |
| GTM user | Full permission in GTM | - |
Common Misconceptions
- "Permissions are given to each user separately." In TR7, permissions come with the role; the scope fields only narrow the limits of the role and do not add a permission the role does not have.
- "Read-only user sees everything." The vServices that Read-only User can see can be limited with User vServices; if the field is left empty, there is no restriction.
- "The group coming from the external server determines the role in TR7." The management user's role is the User Type in the user record on TR7; LDAP, RADIUS or TACACS+ verifies only the password (What is the difference between authentication and authorization?).
How it is done in the documentation
Related questions
- What is the least privilege principle; how is it met in TR7 user management?
- Can I define users who only have monitoring rights, or who can manage only specific vServices?
- How do I make sure a user edits only the vServices assigned to them and does not touch Backend Services and certificates?
- What is the difference between authentication and authorization?
