RBAC

User Role Design ¶

Scope Actions Reference ¶

Scope Resources Reference ¶

User permissions ¶

User permissions in EMS are managed through a combination of user roles and group memberships. Each user is assigned a role that defines their baseline permissions, and they can inherit additional permissions through group memberships.

User Group Design ¶

Overview ¶

User groups in EMS are designed to streamline permission management by grouping users with similar roles and responsibilities. Integrating with MyID allows for automatic user onboarding and group membership assignment based on existing organizational structures.

Group Permission Model ¶

Each user group has two role levels for different member types:

Group Configuration Example ¶

┌─────────────────────────────────────────────────────────────────┐
│  User Group: "pcc-team"                                         │
│  ├── Admin Role: PccAdmin                                       │
│  ├── Member Role: PccAnalyst                                    │
│  │                                                              │
│  ├── Group Admins: (inherit PccAdmin permissions)               │
│  │   └── lead@cisco.com                                         │
│  │                                                              │
│  └── Group Members: (inherit PccAnalyst permissions)            │
│      ├── analyst1@cisco.com                                     │
│      └── analyst2@cisco.com                                     │
└─────────────────────────────────────────────────────────────────┘

Permission Resolution ¶

User's effective permissions = User Role ∪ All Group Roles (based on member type in each group)

Example: - User: john@cisco.com - User Role: Guest - Groups: - "pcc-team" as Group Admin → PccAdmin - "ops-team" as Group Member → OpsMember - Effective Permissions: Guest + PccAdmin + OpsMember

Group Admin vs Group Member Capabilities ¶

Typical Role Pairings ¶

User Group sync with MyID ¶

When integrating with MyID groups, we discovered that: - One user typically belongs to many MyID groups (10-50+ groups) - Syncing all MyID groups to EMS would create a messy, unmanageable group structure - Most MyID groups are irrelevant to EMS operations (e.g., company-wide, regional, HR groups)

Solution: Manual Group Creation with MyID Name Matching ¶

Instead of auto-syncing all MyID groups, EMS uses a selective matching approach:

1. Admin manually creates user groups in EMS
2. Group name matches the relevant MyID group name exactly
3. New users are auto-assigned to matching EMS groups based on their MyID group membership
4. Group roles (admin/member) are defined in EMS during group creation

Sync Strategies ¶

Configuration Options ¶

Edge Cases ¶