Users, Roles & RBAC Policies
Security and access control are paramount for enterprises storing sensitive IT contracts, resilience audits, and strategic architectures.
EasyEA features a comprehensive Role-Based Access Control (RBAC) architecture powered by cryptographic JWT sessions, instant revocation, and granular permissions.
1. Predefined Enterprise System Roles
Inside Admin Hub ➔ User Management & Roles (UserManagement), administrators assign one of 5 canonical roles:
| Role | Scope | Key Permissions |
|---|---|---|
| Admin | System Administration | Full authority over user accounts, roles, workspace configuration, audit logs, SSO, and enterprise API keys. |
| Enterprise Architect | Governance & Metamodel | Authority over custom metamodel attributes, .eap package lifecycle, schema/ADR approvals, and executive views. |
| Solution Architect | Design & Modeling | Creation and editing of elements, relationships, schemas, diagram check-out/in, and ADR authoring. |
| Reviewer | Quality Assurance | Inspection of diagrams in In Review state, revision commenting, and preliminary sign-off. |
| Viewer / Stakeholder | Read-Only Access | Browsing Business Hub dashboards (APM, TIME, Overlap, Resilience) and viewing approved diagrams. |
2. User Provisioning & Password Governance
The administration portal governs the full credential lifecycle:
- Initial Password Provisioning: Admins assign temporary credentials adhering to enterprise complexity rules (minimum length, special characters, numbers).
- Admin Password Reset Modal (
ResetPasswordModal):- Administrators can reset passwords for locked or compromised accounts on demand.
- Upon reset, EasyEA immediately invalidates all active JWT tokens across all browser sessions, enforcing instant logouts.
- Self-Service Credential Updates: Authenticated users can change their personal passwords directly within their profile preferences.
3. RBAC Enforcement Modes: Hybrid vs. Strict
Configured via the EASYEA_RBAC_MODE environment variable:
1. hybrid Mode (Recommended for Internal Corporate Intranets)
- Internal intranet/VPN stakeholders can browse executive dashboards and approved schemas in read-only mode without logging in.
- Authentication is strictly required the moment a write action is attempted: element creation, schema check-out, Schema-as-Code imports, or admin settings.
2. strict Mode (Recommended for Public Cloud & Zero-Trust Networks)
- All endpoints, views, and APIs reject unauthenticated requests.
- Every HTTP request requires an active, verified JWT bearer token matching workspace and role constraints.