{"id":52506,"date":"2026-07-13T11:02:34","date_gmt":"2026-07-13T09:02:34","guid":{"rendered":"https:\/\/firstware.com\/?page_id=52506"},"modified":"2026-09-07T16:55:38","modified_gmt":"2026-09-07T14:55:38","slug":"role-based-access-control","status":"publish","type":"page","link":"https:\/\/firstware.com\/en\/features\/role-based-access-control\/","title":{"rendered":"Role-Based Access Control"},"content":{"rendered":"
\r\n
\r\n
\r\n

Precise access rights<\/span><\/p>\n

Role-Based Access Control <\/span><\/strong><\/span>(RBAC)<\/h1>\n
\n
\n

Exactly the rights each role really needs<\/h2>\n

With Role-Based Access Control (RBAC) in the FirstWare IDM-Portal, you define via roles who may manage which users or attributes, for example by function, department or location. Anyone who wants to make changes in the portal needs an appropriate role, following the principle of least privilege.<\/p>\n<\/div>\n<\/div>\n<\/div><\/div>\r\n\r\n

We are happy to advise you<\/a><\/div>\r\n\r\n\r\n<\/div>\r\n\r\n
\r\n
\"Role-Based<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n
\r\n
\r\n
\"Siegel<\/span><\/div>

Made in Germany<\/p>\n<\/div><\/div><\/div><\/div>\r\n<\/div>\r\n\r\n

\r\n
\"firstware-dsgvo-nis2-konform\"<\/span><\/div>

GDPR- & NIS2-compliant<\/p>\n<\/div><\/div><\/div><\/div>\r\n<\/div>\r\n\r\n

\r\n
\"firstware-25-Jahre\"<\/span><\/div>

25 years of IAM expertise<\/p>\n<\/div><\/div><\/div><\/div>\r\n<\/div>\r\n\r\n

\r\n
\"Vendor-<\/span><\/div>

Vendor- & cloud-independent<\/p>\n<\/div><\/div><\/div><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n

\r\n
\r\n
\r\n

Quick<\/span> Navi<\/h2>\n<\/div><\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n
\r\n
\r\n
\uf0ab<\/span><\/span><\/div>

Roles<\/h2>

To the role model<\/p>\n<\/div><\/div><\/div><\/div>\r\n<\/div>\r\n\r\n

\r\n
\uf0ab<\/span><\/span><\/div>

Granularity <\/h2>

To detailed control<\/p>\n<\/div><\/div><\/div><\/div>\r\n<\/div>\r\n\r\n

\r\n
\uf0ab<\/span><\/span><\/div>

Approvals<\/h2>

To approvals<\/p>\n<\/div><\/div><\/div><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n

\r\n
\r\n
\r\n

Reality Check:<\/span>
Why permissions get out of control without a role model<\/h2>\n

 <\/p>\n

\n
\n

Without a clear role model, the number of access rights grows faster than anyone can keep track of.<\/p>\n<\/div>\n<\/div>\n<\/div><\/div>\r\n\r\n

\uf057<\/span><\/span><\/div>

Inconsistent assignment of rights<\/h4>

Two employees with identical positions have different access rights.<\/p>\n<\/div><\/div><\/div><\/div>\r\n\r\n

\uf057<\/span><\/span><\/div>

Overprivileged accounts<\/h4>

When in doubt, permissions are granted too generously.<\/p>\n<\/div><\/div><\/div><\/div>\r\n\r\n

\uf057<\/span><\/span><\/div>

Missing access slows down work<\/h4>

Essential permissions are missing, and work comes to a halt.<\/p>\n<\/div><\/div><\/div><\/div>\r\n\r\n

\uf057<\/span><\/span><\/div>

No answers during audits<\/h4>

In an audit, identifying who has access to what becomes a time-consuming investigation.<\/p>\n<\/div><\/div><\/div><\/div>\r\n\r\n\r\n\r\n

Book a demo now<\/a><\/div>\r\n<\/div>\r\n\r\n
\r\n
\"Without<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n
\r\n
\r\n
\r\n

Role-Based Access Control with the IDM-Portal<\/span><\/h2>\n<\/div><\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n
\r\n
\r\n
\"Role-Based<\/span><\/div>\r\n<\/div>\r\n\r\n
\r\n

Precise access rights <\/span>for all identities<\/h3>\n

Every role gets exactly what it needs<\/strong><\/p>\n

In the FirstWare IDM-Portal, you define roles based on function, department or location. An administrator sees different areas than the help desk or HR. Each role is linked to exactly the permissions required for its specific task.<\/p>\n

When an employee's position changes, their access changes automatically as well. No one keeps more permissions than their current role requires.<\/p>\n

This also applies to location-based teams: instead of full access to the native directory, they work exclusively through the FirstWare IDM-Portal. For your central IT team, this means greater control over who can actually manage which identities.<\/p>\n<\/div><\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n

\r\n
\r\n

Granular control<\/span> down to the last detail<\/h3>\n

Not just whether access is granted, but exactly how it is used<\/strong><\/p>\n

RBAC in the FirstWare IDM-Portal controls far more than access alone. Using additional attribute-based rules (ABAC), you define individually for each object type what a role is allowed to do.\u00a0<\/p>\n

Creating, changing, deleting, setting group memberships or scheduling time-limited changes \u2013 each of these actions can be allowed or denied individually, independently of the others. A setup such as \"may read, but not edit\" is just as possible as role-dependent views within the portal itself.<\/p>\n

This means different departments see only the data relevant to their area for the same employee.<\/p>\n<\/div><\/div>\r\n<\/div>\r\n\r\n

\r\n
\"Granulare<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n
\r\n
\r\n
\"Role-Based<\/span><\/div>\r\n<\/div>\r\n\r\n
\r\n

Faster\u00a0<\/span>decisions<\/h3>\n

Approvals that do not have to end up with IT
<\/strong>
The decision about a permission does not necessarily have to sit with IT. Based on roles, you define which key users or managers may approve access requests themselves, aligned with their specific area of responsibility.<\/p>\n

Whether a new employee joins a department or an existing employee requests access to a project folder, the responsible team lead or resource owner is automatically notified by email and decides directly.<\/p>\n

As soon as a request is approved, the permission is created automatically according to the rules defined for the relevant role.<\/p>\n<\/div><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n

\r\n
\r\n
\r\n

What is the FirstWare IDM-Portal?<\/span><\/p>\n

Flexible IAM solution for Identity Governance & Administration<\/h2>\n

\u00a0<\/p>\n

The FirstWare IDM-Portal is a user-friendly IAM solution for automated provisioning and lifecycle management of all identities and groups in complex, hybrid IT landscapes.<\/p>\n

Powered by my-IAM<\/strong> \u2013 the underlying technology platform that enables seamless connection of any IT systems and cloud services.<\/p>\n<\/div><\/div>\r\n\r\n

LEARN MORE<\/a><\/div>\r\n<\/div>\r\n\r\n
\r\n
\"Flexible<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n
\r\n
\r\n
\r\n

A role model for your entire IT landscape<\/span><\/h2>\n

 
\nWhether cloud-native or hybrid: your roles and permissions apply consistently across all connected systems, including Microsoft Entra ID and other directory services.<\/p>\n<\/div><\/div>\r\n\r\n

N<\/span><\/span><\/div>

HR integration<\/h4>

Personio, SAP SuccessFactors, SD Worx \/ Loga3<\/p>\n<\/div><\/div><\/div><\/div>\r\n\r\n

N<\/span><\/span><\/div>

Identity Providers & Directories<\/h4>

Microsoft Entra ID, Keycloak, hybrid infrastructures<\/p>\n<\/div><\/div><\/div><\/div>\r\n\r\n

N<\/span><\/span><\/div>

Specialized & industry software<\/h4>

Dedalus Orbis, SQL integrations, CSV- & API connectors<\/p>\n<\/div><\/div><\/div><\/div>\r\n\r\n\r\n\r\n

Book a demo now<\/a><\/div>\r\n<\/div>\r\n\r\n
\r\n
\"FirstWare<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n
\r\n
\r\n
\r\n

Your benefits<\/h2>\n<\/div><\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n
\r\n
\r\n
\"Precise<\/span><\/div>

Precise roles for every employee<\/h4><\/div><\/div><\/div>\r\n<\/div>\r\n\r\n
\r\n
\"Role-Based<\/span><\/div>

Granular control by role and attribute<\/h4><\/div><\/div><\/div>\r\n<\/div>\r\n\r\n
\r\n
\"No<\/span><\/div>

No direct system access needed<\/h4><\/div><\/div><\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n
\r\n
\r\n
\"Individual<\/span><\/div>

Individual views by role<\/h4><\/div><\/div><\/div>\r\n<\/div>\r\n\r\n
\r\n
\"Approvals<\/span><\/div>

Approvals by departments<\/h4><\/div><\/div><\/div>\r\n<\/div>\r\n\r\n
\r\n
\"Audit-<\/span><\/div>

Audit- and compliance-ready<\/h4><\/div><\/div><\/div>\r\n<\/div>\r\n<\/div>\r\n
<\/div><\/div>\r\n\r\n
\r\n
\r\n
\r\n

Frequently<\/span> Asked Questions<\/h2>\n<\/div><\/div>\r\n\r\n

Frequently asked questions about Role-Based Access Control (RBAC), central role models, targeted access control and secure rights assignment with the FirstWare IDM-Portal.<\/p>\n<\/div><\/div>\r\n\r\n

What is RBAC (Role-Based Access Control)?<\/h3>

RBAC (Role-Based Access Control) is a model in which access rights are assigned not to individual people, but to defined roles, for example based on function, department or location. Everyone with the same role automatically receives the same permissions.<\/p>\n<\/div><\/div>\r\n\r\n

What is a role in the IDM-Portal?<\/h3>

A role in the FirstWare IDM-Portal defines who or what the \"role holder\" is allowed to manage. In concrete terms, this means which users or which specific user attributes they may manage (read, edit or delete).\u00a0<\/p>\n

Roles can be set up in different ways:<\/p>\n