Roles
RSA defines two permission roles:
Role | Purpose | Allowed Operations |
|---|---|---|
RSA-View | Read-only access | List devices, retrieve access codes, view code details, download tunnel clients, count codes |
RSA-Manager | Full management access | All RSA-View operations plus create access codes, delete access codes, bulk delete expired codes |
Role Hierarchy
administration (group)
|
+-- RSA-Manager(<node_path>)
| |
| +-- RSA-View(<node_path>) (Manager implicitly includes View)
|
|
+-- RSA-View(<node_path>)
* Members of the administration group automatically hold both RSA-Manager and RSA-View.
* Users with RSA-Manager automatically have RSA-View for the same scope -- there is no need to assign both.
* RSA-View also grants Device-View for the same scope, allowing users to see the devices in the tree.
Permission Scoping
Permissions are scoped to paths in the device tree hierarchy. The device tree organizes gateways under groups:
ROOT/
+-- group-A/
| +-- mprm.osgi.device_GW1/
| +-- mprm.osgi.device_GW2/
+-- group-B/
+-- mprm.osgi.device_GW3/
When a permission is assigned, it includes a node path that defines the scope:
Permission | Scope |
|---|---|
RSA-Manager(ROOT/group-A/mprm.osgi.device_GW1/*) | Manage only GW1 |
Rsa-Manager(ROOT/group-A/*) | Manage all gateways under group-A |
RSA-Manager(ROOT/*) | Manage all under ROOT (global) |
RSA-View(ROOT/*) | View all under ROOT (global) |
Scope Resolution
When a user performs an operation on a gateway, the system:
- Resolves the gateway ID to its full hierarchical node path (e.g., GW1 resolves to ROOT/group-A/mprm.osgi.device_GW1/).
- Checks the user's permissions against that path.
- If the user lacks scoped permission for the specific path, the system checks for a global (wildcard) permission.
If neither check passes, the request is denied with HTTP 401 Unauthorized.
Access Levels
The system supports three tiers of access, checked in order:
Level | Description | Typical User |
|---|---|---|
System Access | Unrestricted access to all operations. | System/service accounts |
Global Access | RSA-View(ROOT/*) or RSA-Manager(ROOT/*). Grants access to all gateways | Platform administrators |
Scoped Access | Permission for a specific node path. Only grants access to gateways within that path. | Scoped users, operators |
Operations and Required Permissions
Viewing (RSA-View required)
All operations which require access to GET endpoints such as retrieving remote access data or downloading a tunnel client require RSA-View permission.
Managing (RSA-Manager required)
All operations which require access to POST or DELETE endpoints such as creating or removing a new remote access entry require RSA-Manager permission.