# RBAC Filter

## Contents
Overview Configuration

## Overview
Role-Based Access Control (RBAC) is used to protect access to the Enterprise Gateway management services. For example, management services are invoked when a user accesses the server using the Policy Studio or Service Manager, requests the Welcome page (`http://localhost:8090/`), or uses the Traffic Monitor or Real-time Monitoring tools. For more information, see Configuring Role-Based Access Control. The RBAC filter is used in the Protect Management and Policy Director Interfaces policy to perform the following tasks: Read the user roles from the configured message attribute (for example, `authentication.subject.role`). Determine which management service is currently being invoked (which URI, and which SOAP operation and namespace, where applicable). Return true if one of the roles has access to the management service currently being invoked, as defined in the `acl.policy file`. Otherwise, return false, and the Return HTTP Error 403: Access Denied (Forbidden) policy is called. The message content of this filter is shown when a valid user has logged into the browser, but their roles do not give them access to the URI they have invoked. For example, this occurs if a new user is created and they have not yet been assigned any roles.
## Configuration
Name: Enter an appropriate name for this filter. Role Attribute: Select or enter the message attribute that contains the user roles. Defaults to `authentication.subject.role`.