RBAC model
Presentation
RBAC stands for Role Based Access Control. It means that you manage authorizations to access applications by checking the role(s) of the user, and provide this role to the application. More informations on http://en.wikipedia.org/wiki/Role-based_access_control LemonLDAP::NG allows to use this model.Roles as simple values of a user attribute
Imagine you've set your directory schema to store roles as values of ssoRoles, an attribute of the user. This is simple because you can send the role to the application by creating a HTTP header (for example Auth-Role) with the concatened values (';' is the concatenation string):
Auth-Roles => $ssoRoles
If the user has these values inside its entry:
ssoRoles: user ssoRoles: admin
Then you got this value inside the Auth-Roles header:
user; admin
Roles as entries in the directory
Now imagine the following DIT:

Roles are entries, below branchs representing applications. Each user has a ssoRoles attributes, which values are the DN of the corresponding roles. With this oragnization, you can set roles to user within specific application.
In the schema above, the user has the following values:
ssoRoles: ou=admin,ou=aaa,ou=roles,dc=acme,dc=com ssoRoles: ou=user,ou=bbb,ou=roles,dc=acme,dc=com
- For application AAA:
default => $ssoRoles =~ /ou=aaa,ou=roles/
- For application BBB:
default => $ssoRoles =~ /ou=bbb,ou=roles/
Second step: get the role name for the application. We will use the macros to do that. Create two macros (inside General Parameters > Macros):
- For application AAA:
aaaRole => ((grep{/ou=aaa/} split(';',$ssoRoles))[0] =~ /ou=(.*),ou=aaa/)[0]
- For application BBB:
bbbRole => ((grep{/ou=bbb/} split(';',$ssoRoles))[0] =~ /ou=(.*),ou=bbb/)[0]
These regular expressions read the 'ou' value of the DN of the role of the concerned application. This work if the user has only one role per application.
Third step: provide the role to the application. It is done by creating the correct HTTP header:
- For application AAA:
Auth-Roles => $aaaRoles
- For application BBB:
Auth-Roles => $bbbRoles
Now the protected application can read in the header HTTP_AUTH_ROLES the role of the user.