How to RBAC

Hello guys! It comes to my attention that people are having difficulties trying to communicate with this RBAC system that shouldn't have been implemented because it generates more support! Anyway, let's begin, shall we?

Contents:

1. Understanding the commands and tables
-1.1. List of the Permissions / Roles / Groups (Default) ~ SQL Structure of all the RBAC tables (DEFAULT)
-1.2. Knowing your configuration
2 Giving GM Permissions
2.1 Giving Full Administrator permissions

~ List of the Permissions / Roles / Groups (Default) ~ SQL Structure of all the RBAC tables (DEFAULT) ~

Here is the default SQL structure of the RBAC tables (EXECUTE in your auth DATABASE):
http://paste2.org/p/3047713

Here is the default Permissions / Roles / Groups ID/NAME:
http://paste2.org/p/3047694

TrinityCore's RBAC (wiki) documentation:
http://collab.kpsn.org/display/tc/RB...Access+Control

~ Knowing your configuration ~


Inside of your worldserver.conf, you will have a configuration setting, like so:

#
# RBAC.DefaultGroups
# Description: Comma separated list of groups to be added to any account
# Check auth.rbac_groups for correct ids
# Default: "" (No group)

RBAC.DefaultGroups = "1"
As it says, once someone I believe registers, logins.. whatever, will be granted with the specified DefaultGroups. The DefaultGroups value can be:

1 = Player
2 = Moderator
3 = GameMaster
4 = Administrator
Or, you can separate the values as it says by commas:

1,2,3,4
1,2
1,2,3

Right now, mine is at 1. Players will only get player permissions.


~ Understanding the commands and tables ~

This is rather simple, so let's start off with the tables before heading into the commands right away.

You should have the following tables:

rbac_account_groups -- Holds data of accounts that have groups
rbac_account_permissions -- Holds data of accounts that have permissions
rbac_account_roles -- Holds data of accounts that has roles set
rbac_group_roles -- Holds data of group roles
rbac_groups -- Holds data of staff groups (Player, GM, etc)
rbac_permissions -- Holds data of permission Id/Names
rbac_role_permissions Holds data of role permissions
rbac_roles -- Holds data of roles Id/Name
rbac_security_level_groups -- Holds data of group security levels (secId)


Now, the main tables that you will be inserting data into are:

rbac_account_groups
rbac_account_permissions
rbac_account_roles

The other tables are basically holding the data that make RBAC what it is. You have commands to look at what permissions/roles/groups you have. You can look at what roles/permissions/groups accounts have by typing:

Roles:
.rbac account role ACCOUNTNAME
Example of (ROLES):
.rbac account role Easelm
This will show what roles account 'Easelm' has from the `rbac_roles` table.

Permissions:
.rbac account permission ACCOUNTNAME
Example of (PERMISSIONS):
.rbac account permission Easelm
This will show what permissions account 'Easelm' from the `rbac_permissions` table.


Groups:
.rbac account group ACCOUNTNAME
Example of (GROUPS):
.rbac account group Easelm
This will show what permissions account 'Easelm' from the `rbac_account_groups` table.

(NOTE): You can select a player ingame and type in these commands to view their groups/permissions/roles without specifying their account name.

.: KNOWING YOUR GROUPS :.

If your `rbac_groups` hasn't been altered, groups should be as followed:

1 = Player
2 = Moderator
3 = GameMaster
4 = Administrator


.: KNOWING YOUR COMMANDS :.

You have 15 commands all together, but don't worry, I'll only explain the ones you'll potentially use.

The main commands you'll most likely use are:

ALSO NOTE: You can set the REALMID to -1 for all realms


.rbac account group add ACCOUNTNAME GROUPID REALMID

Example of command '.rbac account group add':
.rbac account group add Easelm 4 -1
The above will grant account 'Easelm' (or the selected player) group 4 which is administrator to all realms (-1).
----
.rbac account group remove ACCOUNTNAME GROUPID

Example of command '.rbac account group remove':
.rbac account group remove Easelm 4
The above will remove account 'Easelm' from group 4.
----
.rbac account role grant ACCOUNTNAME ROLEID REALMID

Example of command '.rbac account role grant':
.rbac account role grant Easelm 4 -1
The above will grant account 'Easelm' role 4 (Administrator Commands) to all realms (-1)
----
.rbac account role deny ACCOUNTNAME ROLEID REALMID

Example of command '.rbac account role deny':
.rbac account role deny Easelm 4 -1
The above will deny account 'Easelm' from using role 4 (Administrator Commands), from all realms (-1)
----
.rbac account role revoke ACCOUNTNAME ROLEID

Example of command '.rbac account role revoke':
.rbac account role revoke Easelm 4
The above will revoke account 'Easelm' from having role 4 (Administrator Commands)
----
.rbac account permission grant ACCOUNTNAME PERMISSIONID REALMID

Example of command '.rbac account permission grant':
.rbac account permission grant Easelm 10 -1
The above will grant account 'Easelm' permission 10 (Administrator permissions) for all realms (-1)
----
.rbac account permission deny ACCOUNTNAME PERMISSIONID REALMID

Example of command '.rbac account permission deny':
.rbac account permission deny Easelm 10 -1
The above will deny account 'Easelm' from using permission 10 (Administrator permissions) from all realms (-1)
----
.rbac account permission revoke ACCOUNTNAME PERMISSIONID

Example of command '.rbac account permission revoke':
.rbac account permission revoke Easelm 10
The above will revoke account 'Easelm' of its permission 10 (Administrator permissions)

(NOTE): You can select a player ingame and type in these commands to assign their groups/permissions/roles without specifying their account name.

~ Giving GM Permissions ~

Now, I tested with this and came up with the results. To give a GameMaster Player, Moderator and GM Permissions, you will need to set their groups, permission and role. Don't get me wrong, it works perfectly.

To do this, we'll use a basic SQL query or the commands.

.: By SQL Query :.

To grant your GameMaster Player, Moderator and GameMaster permissions do (Will be more commands):
Code:

INSERT INTO `rbac_account_groups` (`accountId`, `groupId`, `realmId`) VALUES
('2', '1', '-1'),
('2', '2', '-1'),
('2', '3', '-1');

INSERT INTO `rbac_account_permissions` (`accountId`, `permissionId`, `granted`, `realmId`) VALUES
('2', '9', '1', '-1');

INSERT INTO `rbac_account_roles` (`accountId`, `roleId`, `granted`, `realmId`) VALUES
('2', '3', '1', '-1');

To grant your GameMaster GameMaster only permissions do (Will be less commands):

Code:

INSERT INTO `rbac_account_groups` (`accountId`, `groupId`, `realmId`) VALUES
('2', '3', '-1');

INSERT INTO `rbac_account_permissions` (`accountId`, `permissionId`, `granted`, `realmId`) VALUES
('2', '9', '1', '-1');

INSERT INTO `rbac_account_roles` (`accountId`, `roleId`, `granted`, `realmId`) VALUES
('2', '3', '1', '-1');

YOU CAN REPLACE THE VALUES WITH YOUR OWN. THEY ARE SPECIFIC AND CAN EASILY BE CHANGED.

.: By Commands :.

Assigning the group(s):

To grant your GameMaster Player, Moderator and GameMaster permissions do (Will be more commands):
.rbac account group add Easelm 1 -1
.rbac account group add Easelm 2 -1
.rbac account group add Easelm 3 -1
To grant your GameMaster GameMaster only permissions do (Will be less commands):
.rbac account group add Easelm 3 -1
Assigning the role:
.rbac account role grant Easelm 3 -1
Assigning the permission(s):
.rbac account permission grant Easelm 9 -1
~ Giving Full Administrator Permissions (All commands) ~

To do this, we'll use a basic SQL query or the commands.

.: By SQL Query :.

Code:

INSERT INTO `rbac_account_groups` (`accountId`, `groupId`, `realmId`) VALUES
('2', '1', '-1'),
('2', '2', '-1'),
('2', '3', '-1');
('2', '4', '-1');

INSERT INTO `rbac_account_permissions` (`accountId`, `permissionId`, `granted`, `realmId`) VALUES
('2', '10', '1', '-1');

INSERT INTO `rbac_account_roles` (`accountId`, `roleId`, `granted`, `realmId`) VALUES
('2', '4', '1', '-1');

YOU CAN REPLACE THE VALUES WITH YOUR OWN. THEY ARE SPECIFIC AND CAN EASILY BE CHANGED.

.: By Commands :.

Assigning the group(s):

.rbac account group add Easelm 1 -1
.rbac account group add Easelm 2 -1
.rbac account group add Easelm 3 -1
.rbac account group add Easelm 4 -1
Assigning the role:
.rbac account role grant Easelm 4 -1
Assigning the permission(s):
.rbac account permission grant Easelm 10 -1

ALWAYS REMEMBER: -1 is ALL REALMS. You can set permissions to a specific realm, for example 1, 2, 3, etc.. (RealmID goes by the amount of realms you have.)


I hope you enjoyed this guide on how to fully comprehend the RBAC system.

Last edited by QQrofl; 03-05-2013 at 06:27 AM.