j4flmao RBAC and OIDC Integration
Purpose
Comprehensive Role-Based Access Control with OIDC flow integration.
Core Principles
- Principle of least privilege
- Secure token validation
- Strict policy enforcement
- Auditability of access
- Separation of duties
Agent Protocol
Triggers: Access requests Input Context Required: User identity, requested resource, action Output Artifact: Access decision Response Formats:
{
"allowed": true,
"reason": "Role has permission"
}
Decision Matrix
[Request] -> [Check Token] -> [Extract Roles] -> [Evaluate Policy] -> [Decision]
Detailed Architectural Overview
Client -> API Gateway -> RBAC Service -> Policy DB
|
v
OIDC Provider
Workflow Steps
Phase 1: Initialization
- Load policies
- Connect to DB
- Init cache
Phase 2: Token Validation
- Parse JWT
- Verify signature
- Check expiry
Phase 3: Role Extraction
- Get claims
- Map to roles
- Resolve hierarchy
Phase 4: Policy Evaluation
- Find matching policies
- Check conditions
- Calculate final decision
Phase 5: Audit Logging
- Format log entry
- Add context
- Write to stream
Phase 6: Response
- Format response
- Add headers
- Send to client
Extended Troubleshooting Guide
| Symptom | Primary Cause | Mitigation Action |
|---|---|---|
| Token rejected | Expired token | Refresh token |
| Role missing | Claim not mapped | Check mapping config |
| Policy failure | Condition not met | Review policy rules |
| High latency | DB slow | Add caching |
| Audit failed | Stream full | Increase capacity |
| Unknown error | Unhandled exception | Check logs |
Complete Execution Scenario
Request -> Valid Token -> Role Admin -> Allow Action
Rules and Guidelines
- Always validate tokens first
- Fail closed on errors
- Log all access decisions
- Cache policies for performance
- Regularly review role mappings
Reference Guides
- OIDC Auth Code Flow
- OIDC Implicit Flow
- RBAC Core Logic
- RBAC Decision Matrix
- RBAC Policy Evaluation
- OIDC Token Validation
- RBAC Audit Logging
- RBAC Integration Patterns
Handoff
Refer to auth skill.