Role-based access control

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. In role-based access control (RBAC), where are permissions first given?

A To roles, like student, teacher or admin

B To each user one at a time

2. On a school network using RBAC, how does a new student get access to the student files?

A The admin sets up a new list of permissions just for them

B They are assigned the student role

3. A student is chosen as a library helper and moved from the student role to the librarian role. What happens to their access?

A It changes to match the librarian role

B It stays the same as the student role

4. Which of these is an example of a role in a school network?

A Teacher

B Password123

5. A teacher leaves the school. What is the RBAC way to remove their access?

A Delete the teacher role for everyone

B Remove their assignment to the teacher role

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1assign(user: mia, role: student)		AMia is given the admin role even though she is a student, so she gets far more access than she needs.
2role: teacher -> read, write		Brole: student -> read
3Changing a user's role changes what they can access		CGives the user Mia the student role, so she gets all the access that the student role has
4Permissions are given to a role, not directly to each user on a school network		Dassign(user: sam, role: admin)
5permission: write -> user: mia permission: write -> user: leo permission: write -> user: zoe		EDefines the permissions that belong to the teacher role, so anyone with this role can read and write
6assign(user: mia, role: admin) // Mia is a student		FPermissions are given to each user one at a time instead of to a role. This is slow and easy to get wrong when many users need the same access.

Definitions

Role-based access control (RBAC)

Fill in the Blanks

Complete each line of code by filling in the missing parts.

____ teacher = [read, write] role student = [read]

role student = [read] ______ Mia to student

assign Sam to student assign Sam to _______ Sam can now read and write

if user.____ == "admin": allow(execute)

role _____ = [read, write, execute] assign Tech_Kim to admin

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A role student = [read]

B role teacher = [read, write]

C assign Mia to teacher

D Mia can: read

Question 2

A assign Mr Lee to teacher

B role teacher = [read]

C Mr Lee can: read, write

Question 3

A role Ali = [read]

B assign Ali to student

C assign Bo to student

Question 4

A assign Zoe to student

B grant write to Zoe

C Zoe can: read, write

Question 5

A role student = [read]

B role teacher = [read, write]

C assign Jo to student

D change Jo role to student

E Jo can: read, write

Answer Key

Role-based access control

Section A: Quick Questions

A — To roles, like student, teacher or admin

B — They are assigned the student role

A — It changes to match the librarian role

A — Teacher

B — Remove their assignment to the teacher role

Section B: Match the Pairs

assign(user: mia, role: student) → Gives the user Mia the student role, so she gets all the access that the student role has

role: teacher -> read, write → Defines the permissions that belong to the teacher role, so anyone with this role can read and write

Changing a user's role changes what they can access → assign(user: sam, role: admin)

Permissions are given to a role, not directly to each user on a school network → role: student -> read

permission: write -> user: mia permission: write -> user: leo permission: write -> user: zoe → Permissions are given to each user one at a time instead of to a role. This is slow and easy to get wrong when many users need the same access.

assign(user: mia, role: admin) // Mia is a student → Mia is given the admin role even though she is a student, so she gets far more access than she needs.

Section C: Definitions

Role-based access control (RBAC) — A way to manage access by giving permissions to roles, like student, teacher or admin, then assigning each user a role. Changing a user's role changes what they can access.

Section D: Fill in the Blanks

role teacher = [read, write]
role student = [read]

role student = [read]
assign Mia to student

assign Sam to student
assign Sam to teacher
Sam can now read and write

if user.role == "admin":
    allow(execute)

role admin = [read, write, execute]
assign Tech_Kim to admin

Section E: Spot the Error

C — Mia is a student, so she should be assigned the student role. Assigning her to teacher would give her write access she should not have.

B — The teacher role must include write so that Mr Lee can read and write. It should be role teacher = [read, write].

A — In RBAC a role is a group such as student, not a single person. The student role is never defined, so it should be role student = [read].

B — RBAC gives permissions to roles, not to individual users. To give Zoe write access, change her role to teacher.

D — Jo is already a student, so this change does nothing. To give Jo read and write access, her role must change to teacher: change Jo role to teacher.