Skip to content

Home

Jump to bottom
Finnegan's Owner edited this page Jul 14, 2026 · 2 revisions

Role Based Access Control

A plugin for Open Integration Engine that enforces role-based access control on the server: dynamic roles, per-permission grants, and channel-level restrictions. It replaces the engine's default authorization controller, which allows every operation for every logged-in user.

This release (v1.1.2) targets OIE 4.6.0 exactly. The engine matches the plugin's declared engine version by exact equality, so after an engine upgrade an un-rebuilt plugin is unloaded and authorization reverts to the default allow-all controller with only a log line. Verify the RBAC settings tab is active after any engine upgrade.

Role-Based Access Control settings tab in the OIE Administrator

How It Works

  1. An administrator defines roles. Each role holds a set of permission grants and an optional list of channels the role is restricted to.
  2. Each user is assigned one role.
  3. The plugin's server-side authorization controller checks every REST operation against the user's role. A denied call returns a 403 that names the missing permission.
  4. The Swing Administrator and the OIE Web Administrator hide the tasks and navigation the role does not grant.
  5. A user with no role is denied everything. The client fails closed too: if permissions cannot be loaded, tasks stay hidden.

Features

  • Dynamic roles — create, edit, and delete roles from the settings tab; changes take effect immediately, no server restart
  • 42 core permissions — every engine permission, grouped by function (Channels, Messages, Alerts, Server Settings, and so on) in the role editor
  • Extension permissions — permission-gated operations of installed plugins appear in the role editor, grouped by plugin
  • Channel restrictions — limit a role to specific channels; a role with no channel list sees all channels
  • Admin-role safety — holders of the admin role bypass all permission checks; the admin role cannot be deleted, and lockout guards keep at least one live admin user assigned
  • Assignment impact preview — before a role is assigned, a confirmation shows the user's current role, the new role's channel scope, and its full permission list
  • Swing and Web Administrator UIs — role management ships as a Settings tab in the desktop Administrator and as a Web Administrator plugin bundled in the same zip
  • REST API — full role and assignment management at /extensions/rbac
  • Signed jars — release jars carry a timestamped code signature

Getting Started

Version Info

Item Value
Plugin version 1.1.2
OIE version 4.6.0
License MPL-2.0
Release v1.1.2

Home

Clone this wiki locally