{"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"role-based-access-control","__idx":0},"children":["Role-based access control"]},{"$$mdtype":"Tag","name":"ConfigOptionRequirements","attributes":{"products":["Redoc","Revel","Reef","Realm"],"plans":["Enterprise","Enterprise+"]},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Role-based access control (RBAC) controls the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["authorization"]}," (what you can access) based on your roles and team membership."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authentication-vs-authorization","__idx":1},"children":["Authentication vs Authorization"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication"]}," identifies who you are through your identity provider (SSO)."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorization"]}," determines what you can access based on:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organization roles"]}," from identity provider claims/attributes (when using SSO) or manual assignment (when using Redocly login)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Project roles"]}," assigned to teams you belong to"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Team membership"]}," managed through identity provider (SSO teams) or through Redocly's Teams page (Reunite-managed teams)"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After authentication, users are granted access to resources based on the permissions included in their assigned roles."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["There are many components to setting up RBAC, the diagram below gives an overview of these components and how they relate to one another."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"graph LR\n\n RBAC\n Resource\n Team\n Role\n Permission\n User\n\n Team --> RBAC\n User -->Team\n\n Role --> RBAC\n Permission --> Role\n \n Resource --> RBAC\n\n","diagramHtml":"

RBAC

Resource

Team

Role

Permission

User

","diagramHtmlDark":"

RBAC

Resource

Team

Role

Permission

User

"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["RBAC is declared as configuration."," ","Each configuration entry describes a ",{"$$mdtype":"Tag","name":"Link","attributes":{"href":"#resource-identifiers"},"children":["resource"]},", and a list of ",{"$$mdtype":"Tag","name":"Link","attributes":{"href":"/docs/realm/reunite/organization/teams"},"children":["teams"]}," with ",{"$$mdtype":"Tag","name":"Link","attributes":{"href":"/docs/realm/access/roles"},"children":["role"]}," assignments."," ","You can apply these configurations to ",{"$$mdtype":"Tag","name":"Link","attributes":{"href":"/docs/realm/access/page-permissions"},"children":["individual pages"]}," or ",{"$$mdtype":"Tag","name":"Link","attributes":{"href":"/docs/realm/access/links-and-groups-permissions"},"children":["navigation elements"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["User authentication is handled through ",{"$$mdtype":"Tag","name":"Link","attributes":{"href":"/docs/realm/reunite/organization/sso/sso"},"children":["single sign-on"]},", and authorization is determined by the roles and team memberships provided by your identity provider."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"resource-identifiers","__idx":2},"children":["Resource identifiers"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When configuring RBAC, you specify access for particular resources using resource identifiers."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A resource identifier may be any of the following:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["a path to a file, for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["docs/configuration.md"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["a route, such as, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/catalog/"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["a ",{"$$mdtype":"Tag","name":"Link","attributes":{"href":"https://en.wikipedia.org/wiki/Glob_(programming)"},"children":["glob pattern"]},", for instance, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["**/*.tsx"]}," will match all ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".tsx"]}," files recursively"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["a special identifier, such as, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["**"]}," ","The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["**"]}," special identifier sets the default role for a team for any content that isn't specified as a resource identifier."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For every resource identifier, your RBAC configuration specifies a team and assigns a project role for that team, for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Developers: read"]},"."," ","Resource identifiers define the scope for the team and role combination."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"example-configuration","__idx":3},"children":["Example configuration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following is an example of a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rbac"]}," configuration in a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redocly.yaml"]}," file:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"rbac:\n reunite:\n authenticated: read\n Admins: admin\n Developers: maintain\n Writers: write\n content:\n '**':\n authenticated: read\n Admins: admin\n Developers: maintain\n Writers: write\n 'docs/developer-keys.md':\n Developers: read\n Writers: read\n 'docs/*.md':\n Developers: write\n Writers: write\n 'public/**':\n Developers: write\n '*': read\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In this example in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["content"]}," option ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["**"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["docs/developer-keys.md"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["docs/*.md"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["**/*.tsx"]}," are resource identifiers."," ","For every resource identifier, the configuration specifies a team and assigns a project role for that team, for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Developers: read"]},"."," ","The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["**"]}," key describes the project role assignments to teams for resources that are not specified in this configuration."," ","For example, a user that belongs to the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticated"]}," team will have ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["read"]}," permission for the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["index.md"]}," file."," ","That file is not included in the three resource identifiers listed."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Assigning the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["*"]}," symbol means that a given project role is assigned to the rest of the teams that are not specified for the resource."," ","In the example, the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Developers"]}," team has the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["write"]}," project role for everything under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["public/"]},"."," ","All other teams have ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["read"]}," permission for those files."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A resource can match more than one pattern described in the RBAC configuration."," ","In that case, only the rules for the best match are applied to that resource."," ","For example, the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["docs/developer-keys.md"]}," file matches both ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["docs/developer-keys.md"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["docs/*.md"]}," entries in the RBAC configuration, but only rules from the first instance are applied."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Under the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["reunite"]}," option, it describes the project role assignments to teams for access to the project."," ","In this example, the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Writers"]}," team has a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["write"]}," project role and can contribute or write comments on reviews."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"rule-precedence-and-defaults","__idx":4},"children":["Rule precedence and defaults"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Explicit RBAC rules defined in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redocly.yaml"]}," take precedence over the default project roles assigned to organization members."," ","By default, organization Members have the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin"]}," project role."," ","If you specify an explicit rule for the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticated"]}," team, that rule applies to all organization Members unless a more specific team rule overrides it."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticated"]}," team is a global team that includes all logged-in users in your organization, regardless of their organization role."," ","Defining ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticated: read"]}," in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rbac.reunite"]}," restricts all organization members to read-only, bypassing their default ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin"]}," role."," ","Owners are unaffected and keep full access to all projects."," ","To keep admin or write access for specific teams, explicitly define their roles (for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Admins: admin"]},")."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"resources","__idx":5},"children":["Resources"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"Link","attributes":{"href":"/docs/realm/access/roles"},"children":["Roles and permissions"]}]}," - Explore the different user roles and permissions available for controlling access to your organization and projects"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"Link","attributes":{"href":"/docs/realm/reunite/organization/teams"},"children":["Manage teams"]}]}," - Configure teams and manage user assignments, including adding users to multiple teams for flexible access control"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"Link","attributes":{"href":"/docs/realm/config/access/rbac"},"children":["RBAC configuration reference"]}]}," - Complete configuration details and options for implementing role-based access control in your projects"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"Link","attributes":{"href":"/docs/realm/content/api-docs/openapi-extensions/x-rbac"},"children":["OpenAPI RBAC extension"]}]}," - Apply RBAC permissions to specific objects and sections within your OpenAPI description files"]}]}]},"frontmatter":{"products":["Redoc","Revel","Reef","Realm"],"plans":["Enterprise","Enterprise+"]},"tagList":["configOptionRequirements"],"title":"Role-based access control","lastModified":"2026-10-01T23:00:57.000Z"}