Implement RBAC management module

[qiangxue]

No description provided.

[joujou]

Don't store bizrule inside Db evaluated with eval().

[samdark]

@joujou any alternatives?

[rclai]

It would be great to have a graphical interface to create roles and capabilities like on gii.

[joujou]

I agree with rclai about the interface. Rights management is involved in almost every webapp so the it'd be great if the framework could give an easy and powerful to manage that. It would be sad to have no other way but using an extension to perform such a sensitive task.
About the bizrule stored in the DB, I don't know what else to do but many people won't use the solution because of the idea of PHP code stored in the DB processed with eval. Class inheritance containing specific rules ? A bit like Zend_Acl. I don't know but I think the subject really disserves to find another solution. It's also important for the framework in general; it could be seen as being not really secure/professionnal/serious because of that PHP in db/eval() process.

[qiangxue]

This issue IS about the RBAC management GUI interface. The RBAC core is covered by #24.

It would be great if you could help summarize the needed features for this module. I expect the underlying RBAC core won't have big change in design.

[rclai]

A role creator for sure. Given that this is an extended user attribute or property of some sort, how will this connect to the user management that people will develop?

Oh, then I suppose the GUI should be able to detect the controllers (and perhaps the module controllers) that are available and link the roles to the controllers?

[rbryant]

IMHO, this is how it should work. A Management application that allows an admin to create a role and then do the following to it:

1. Assign access to modules based upon a system generated list of user accessible modules. Could be defined through a parameter in each model. Each module that the role should access could be selected and would have the CRUD options laid out and you could "check" the ones that this role should be able to perform.
2. Each user could be assigned one or multiple roles
3. A combination of rights through the Roles would be the Users Rights.
4. The rights Management Engine could then apply those rights through a standard way storing only data in the db.

You could include or choose not to include that rights function in your controllers. You could even define some kind of encryption code as a system configuration that obfuscated those rights in the db for extra protection. I would not be in favor of storing PHP in the tables either, but this approach would give you the same functionality without it. A Developer could extend the Rights Management code to customize behavior.

[creocoder]

Don't store bizrule inside Db evaluated with eval().

There is NO alternatives. So store.

[miraage]

About web interface - I like implementation of access rules in Invision Power Board - rows with modules and columns with crud actions.

[joujou]

Of course there are alternatives ! I think you haven't search a lot creocoder.

[creocoder]

@joujou There can be unique bizrules for every user / auth item assotiation. So if not store in db, such files size can reach 1, 10, 100 Mb. Seems you just do not solve complex RBAC tasks. So bizrules should be stored in db as main variant and yes, storing in files like alt variant.

[qiangxue]

If the RBAC module is to be used by someone who is not 100% reliable, you should not let him directly store expressions in DB. Instead, you should create GUI so that he can select some pre-defined expressions.

Internally, I don't see alternative either.

[bwoester]

I think bizRules should be splitted into callbacks and data. So instead of storing code to be executed, you store classname, (static) method name and the data that should be passed to that method. This way you know at design time which code will be executed and don't have to rely on your users to provide valid code that you blindly trust. I think this should cover almost all use cases. If there really is someone who wants to give his users the possibility to run their own code, he can still use a callback that simply eval's its param.

[psihius]

I probably have a weird view for the GUI, but I really like the idea behind the SRBAC module (we use it in all our projects). To the contrary of my case, most of the people seemed to use Yii-Rights module for that, and although it has nice UI, it's usability is way off for any serious project with lots of auth items and numerous roles.
SRBAC UI, althought not pretty and somewhat not intuative at first glance, is great for handling mass assignments of stuff - it's very easy to create a role and add like 50 tasks to it in a few clicks.
It also has a nice concept of "clever assignment", but it got broken at some point, probably because we hacked it a little for our special needs. We hacked it to handle multiple controller directories like "dirname.controllerAction" - we use it to build multiple projects on a single code base - I can provide additional information on how and what if needed, just ask @samdark to contact me :)

[joujou]

The alternative is to create custom classes containing the specific logic. Storing PHP code in DB processed with eval is an easy but insecure solution. It's like storing a part of the code application in the DB, so why not store whole functions or even the whole application in the db and process it with eval :)

[githubjeka]

👍 for joujou

How can we help to make this issue has been resolved soon?

I don't like something in third-party modules always. And they creates more and more.

p.s I would like to make something beautiful, like debug module or gii

[samdark]

@githubjeka I have an idea about using something like http://jsplumb.org/ for it.

[githubjeka]

hmm very intresting at first sight. But it certainly complicates the understanding rbac for some.

[lynicidn]

имхо лучше в классическом ввиде парент и предки, без схем, привязок меньше у модуля

[samdark]

The fact that it's a graph is a key to understanding how it works so I think something like jsplumb is much better than a flat hierarchy.

[githubjeka]

When relationships become much, it would be difficult to understand, perhaps.
Probably better to use a simpler interface, as table or something ui known for coders.

[dynasource]

Nice progress @githubjeka
I agree with @patlecat in using

• graphs for understanding
• tables for editing

[githubjeka]

I use table for assign role to user only. This module for others. But no time for update interface...

[Faryshta]

I have a PR open #6872 so far it has passed all the unit testing, I don't know whats needed for merging

[missjewel]

how install this module for template advanced yii2?
And have interface it?

[githubjeka]

https://github.com/githubjeka/gui-rbac-yii2#use-on-local

[missjewel]

and please how executo o run this module? the route. I have prettyURL then controller/action.

[githubjeka]

https://github.com/githubjeka/gui-rbac-yii2/blob/master/config/web.php#L10\

index.php?r=rbac

[githubjeka]

Added new features. [repo]
See demo

[patlecat]

When I double-click to delete/modify a node I cannot get out of the delete-mode anymore. Nothing worked.

[githubjeka]

Hmm..
When you dbclick on node then node selected to form. Push red delete button.

The moment of CRUD implemented via form isn't perfect. I don't like it myself. But so far I haven't heard how best to do it.

[patlecat]

No man, how can I leave the delete-mode without deleting anything?

[githubjeka]

Push white reset-form button

[githubjeka]

New features. 🌱
Added a search block. Now you can search roles and permissions by name.
Added style to a marked node.

have fun

[repo] demo

[samdark]

Great!

[nkostadinov]

Guys this is nice but it looks over complicated.

[githubjeka]

than what?

[samdark]

@nkostadinov any concrete suggestions?

[nkostadinov]

The RBAC system is very flexible but in real life, no one will want to arrange these graphs while setting permissions. My current RBAC implementation has only one group per user and this group holds the permissions(like "yes"/"no") - simple as that. There is no inheritance, no complex graphs ... It's working on a very large scale at one of the biggest telco's in Bulgaria and is doing it's job perfectly.

I'm currently working on something like this for yii2 but it's not ready yet. The idea is to have a basic user extension, and to add "plugins" implementing different functions. I just like to keep it simple :)

Anyway I'm not saying nothing bad about this, just discussing here.

[samdark]

Complexity of RBAC permissions graph depends very much on the nature of the project. If it is about community and is something like StackOverflow where you're getting more permissions and moving towards the top of the hierarchy depending on your actions, the graph could be quite complex.

The RBAC management extension discussed here is able to visualize it nicely so one could get a good overview and fix some bugs.

Of course, if you know that simpler hierarchy is OK for the project and you're quite sure that it's not gonna change, UI could and should be simplified.

[githubjeka]

I have one idea - auto create a migration for every action CRUD yii\rbac\Item.
What you think? Can somebody show me example file with simple rbac migration?

[samdark]

Yep, that could work.

<?php

use yii\db\Schema;
use yii\db\Migration;

class m150910_204507_init_blog_rbac extends Migration
{
    public function up()
    {
        $auth = Yii::$app->authManager;

        $manageBlog = $auth->createPermission('manageBlog');
        $manageBlog->description = 'Manage blog';
        $auth->add($manageBlog);

        $admin = $auth->createRole('admin');
        $admin->description = 'Administrator';
        $auth->add($admin);
        $auth->addChild($admin, $manageBlog);
    }

    public function down()
    {
        Yii::$app->authManager->removeAll();
    }
}

[samdark]

Won't be implemented in the core since it's to flexible to have a universal UI.

[yasseralmofaalani]

how to assign roles to users

[SilverFire]

http://www.yiiframework.com/doc-2.0/guide-security-authorization.html#generating-rbac-data