Skip to main content

Role Based Access Control (RBAC)

Warrant provides out-of-the-box support for implementing Role Based Access Control (RBAC) using the built-in user, role, and permission object types.

Users, roles, and permissions can be created and managed from the Warrant Dashboard or via the API. This quickstart will walk you through setting up your roles & permissions and adding permissions checks to your application.

1. Create Permissions

First, we'll create our application's permissions in Warrant. You can create permissions once manually (if the set of permissions for your application is finite) and/or programmatically from your application code using the Warrant SDK. To create a permission you need to provide it a unique string identifier:

Create permissions
warrant create permission:view-dashboards
warrant create permission:create-dashboards
warrant create permission:edit-dashboards
warrant create permission:delete-dashboards

2. Create Roles

Next, we'll create our application's roles. Ideally, the set of roles within an application should be finite and is usually well-defined upfront and so roles should only have to be created once (or infrequently). Like permissions, to create a role you need to provide it a unique string identifier:

Create roles
warrant create role:admin
warrant create role:basic

3. Assign Permissions to Roles

The roles we created aren't useful until we assign permissions to them. Let's assign the view-dashboards permission to the basic role and all four permissions to the admin role.

Assign permissions to roles
warrant assign role:basic member permission:view-dashboards

warrant assign role:admin member permission:view-dashboards
warrant assign role:admin member permission:create-dashboards
warrant assign role:admin member permission:edit-dashboards
warrant assign role:admin member permission:delete-dashboards

4. Assign Roles to Users

Now that our roles are assigned permissions, we can assign them to users. Users can be assigned multiple roles. Let's create two users and assign each of them one of the roles we created.

Assign roles to users
warrant assign user:123 member role:admin
warrant assign user:456 member role:basic

6. Assign Permissions to Users (optional)

Permissions can also be directly assigned to users. Let's assign edit-dashboards to a user.

Assign permissions to users
warrant assign user:123 member permission:edit-dashboards

7. Check for Permissions in your Application

Once our roles and permissions are defined and assigned amongst users, we can start to check permissions on specific users as such:

Check for permissions
# Returns true
warrant check user:123 member permission:delete-dashboards

# Return false
warrant check user:456 member permission:delete-dashboards

Self Service RBAC

Following this quickstart guide, you should be able to setup RBAC for your application. Particularly for B2B applications, as your application continues to mature, your customers might ask you for the ability to manage their team's roles and permissions themselves.

The Warrant Self Service Dashboard is a Warrant-hosted page you can embed into your application to allow your users to manage their own organization's roles and permissions. See the Self Service RBAC guide for more details.