RBAC Configuration

The RBAC add-on sets up role-based access control in the Illumio platform so each user has the access their job requires and nothing more.

Illumio RBAC is built on users and permissions. Each permission combines a role, an optional scope, and the user or group it is granted to. Roles define what a user can do, such as creating labels or provisioning policy changes. Scopes limit those actions to workloads that carry specific Application, Environment, and Location labels. Because scopes are made of labels, RBAC design depends on the customer's label schema. For that reason this add-on is delivered alongside the Labeling engagement.

Illumio Professional Services works with the customer to define its access goals, including separation of duties and whether application owners need access. It then maps those goals to Illumio roles, scopes, and identity-provider groups and configures RBAC in the PCE.

At the end of the engagement, the customer has a working RBAC configuration for its current needs, a document describing the design, and a template and instructions for adding roles, scopes, and groups on its own.

Package Dependencies

• Platform Foundation Deployment
• Labeling  

This add-on can be attached to the Visibility, Containment, or Segmentation Bundle, since all three include both prerequisite packages.  

Technical Readiness

• Operational PCE
• Label schema defined through the Labeling engagement, including Application, Environment, and Location labels used for scopes
• If an identity provider is used: SSO configured, and external users and groups added to the PCE before permissions are assigned
• Administrative access to the PCE for Illumio Professional Services  

Customer Readiness

• Project manager or primary point of contact assigned
• High-level access goals identified, including separation-of-duties needs and application-owner access requirements
• Customer-provided role definitions for the users and teams in scope
• Identity provider group names identified, where applicable Identity and access management stakeholders available

RBAC Requirements and Design

• Explain Illumio RBAC concepts: users, permissions, roles, scopes, and how access is bound to users and groups.
• Review the customer's access goals, separation-of-duties needs, and application-owner access requirements.
• Map customer-provided role definitions to Illumio global and scoped roles.
• Design scopes using the customer's Application, Environment, and Location labels.
• Map roles and scopes to identity provider groups or local users.
• Agree the RBAC design with customer stakeholders.

Customer Outcome

The customer has an agreed RBAC design that connects its organizational roles to Illumio permissions and label-based scopes.

RBAC Configuration and Validation

• Configure the agreed RBAC roles and associated groups, up to the limit of the purchased size.
• Configure label-based scopes for scoped roles.
• Bind roles and scopes to identity provider groups or local users.
• Validate that users receive the intended access and that scoped users are limited to workloads within their scope.
• Resolve configuration issues within the Illumio platform.

Customer Outcome

The customer has a working RBAC configuration in the PCE that gives each user group the intended level of access.

Documentation and Handoff

• Provide a document describing the RBAC design and configuration.
• Provide a template for future RBAC additions and changes.
• Provide instructions for adding roles, scopes, and group mappings after the engagement.
• Explain how label changes affect scoped access. Review the configuration and documentation with customer stakeholders.

Customer Outcome

The customer can maintain its RBAC configuration and extend it to new teams, applications, and scopes without further Professional Services involvement.

This add-on is delivered alongside the Labeling engagement, since scopes depend on the label schema. The schedule is set at project initiation based on:

• Purchased block size
• Number of roles, scopes, and groups
• Identity provider readiness
• Label schema readiness
• Stakeholder availability and review cycles.

Delays in SSO readiness, identity provider group setup, label schema decisions, or customer approvals may affect the schedule.

Talk to our Sales team to learn more about Services.

Explore our Professional Services at illumio.com/services/professional-services