I have implemented security models many times, and I also had to consider these concepts. Having done this many times, here is my understanding of these concepts.
What are the roles
Role = Union of users and rights.
On the one hand, a role is a set of permissions. I like to call it permission. When defining a role, you basically add a set of permissions to this group, so in this sense, a role is a permission profile.
The Role, on the other hand, is also a collection of users. If I add Bob and Alice to the Managers role, the Managers now contain a collection of two users, like a group.
The truth is that a role is both a collection of users and a collection of permissions combined. Visually, this can be seen as a Venn diagram.
What is a group?
Group = User Collection
A "group" is strictly a group of users. The difference between a group and a role is that the role also has a collection of permissions, and the group only has a collection of users.
What is permission?
Resolution = What subject can do
What is a permission set?
Permission set = permission set
In a robust RBAC system, permissions can also be grouped as users. While groups are a set of users only, a permission set is a set of permissions only. This allows the administrator to simultaneously add entire permission collections to roles.
How users, groups, roles, and permissions come together
In a robust RBAC system, users can be added to a role individually to create a collection of users in a role, and groups can be added to a role to simultaneously add a collection of users to a role. In any case, the Role gets its user collection from individually adding or adding groups to the role or by adding a combination of users and groups to the role. Permissions can be considered in the same way.
Permissions can be added to roles individually to create a collection of permissions within a role or permission sets can be added to a role. Finally, a combination of roles and permission sets can be added to the role. In any case, the Role gets its collection of permissions from adding individually or by adding sets of permissions to the role.
The whole purpose of the roles is to marry users with permissions. Therefore, the role is the UNION of users and permissions.
What claims
Claim = What is a "subject"
Claims are not permissions. As stated in previous answers, Claim is that the subject “is” and not what the subject “can” do.
Claims do not replace roles or permissions; they represent additional information that can be used to make an authorization decision.
When to use a claim
I believe that statements are useful when you need to make an authorization decision, when a user cannot be added to a role, or the decision is not based on the user's association with the permission. An example of a Facebook user calls this. A Facebook user cannot be someone added to the Role ... he is just some kind of visitor authenticated via Facebook. Although this does not fit into the RBAC, it is part of the information by which an authorization decision must be made.
@CodingSoft used the nightclub metaphor in the previous answer, which I would like to expand. In this answer, the driver’s license was used as an example, which contained a set of claims in which the date of birth is one of the claims and the value of the DateOfBirth requirement is used to check for compliance with the authorization rule. The government that issued the driver’s license is the authority that authenticates the claim. Thus, in a nightclub scenario, the bouncer at the door looks at a person who has a driver’s license, ensures that it was issued by a trusted authority, checking if it is a fake ID (i.e. Must be a valid ID issued by the government), then looks on the date of birth (one of many claims for a driver’s license), and then uses this value to determine if an adult is enough to enter the club. If so, the person passes the authorization rule by virtue of a valid claim, and not in any role.
Now, bearing in mind this base, I would like to expand it. Suppose that in the building where the nightclub is located, there are offices, rooms, a kitchen, other floors, elevators, a basement, etc., Where only club staff can enter. In addition, some employees may have access to certain places, while others may not. For example, a manager may have access to the office floor above, which other employees cannot access. In this case, there are two roles. Manager and employee.
While visitors' access to the public nightclub area is allowed with one complaint, as explained above, employees need to use roles to access other non-public rooms with limited access. Driving license is not enough for them. They need an employee badge, which they scan to enter the door. Somewhere there is an RBAC system that provides badges in the role of manager with access to the upper floor, and badges in the role of employee - access to other rooms.
If for any reason a specific room needs to be added / deleted using a role, this can be done using RBAC, but this is not suitable for the application.
Software Permissions
Encoding roles in an application is a bad idea. This hardcodes the purpose of the role in the application. An application should only have permissions that act as functional flags. When function flags become accessible through configuration, permissions become available due to the user's security context, which is defined by the collection of DISTINCT permissions collected for all roles the user was placed into. This is what I call effective permissions. The application should only present a menu of possible permissions for functions / actions. The RBAC system must do the work of combining these permissions with users through roles. Thus, there is no hard coding of roles, and the only time a permission is changed, when it is deleted or a new one is added. Once a resolution has been added to the software, it should never be changed. It should be deleted only if necessary (i.e. when the function is terminated in the new version), and only new ones can be added.
Last comment
Grant vs Denis
A reliable RBAC system and even a CBAC system must distinguish between grants and failures.
Adding permission to a role must be accompanied by either GRANT or DENY. When permissions are checked, all permissions granted must be added to the list of users of valid permissions. Then, after all this is done, the list of CONCLUDED permissions should force the system to remove these permissions from the list of valid permissions.
This allows administrators to "tune" the subject's final permissions. It is best if permissions can also be added directly to users. Thus, you can add the user to the role of manager, and he will have access to everything, but you might want to DAY to get access to the women's restroom, because the user is a man. Thus, you add the male user to the manager role and add permission for the user object using DENY, so that he would deny access only to this lady room.
In fact, it would be a good candidate for a claim. If the user has a claim "gender = man", then the presence in the role of manager gives access to all rooms, but in the Lady’s toilet the claim is also gender = woman, and in the men's room claims are gender = man. Thus, it would not be necessary to configure the DENY permission for male users, since the enforcement of claims takes care of this for all with one authorization rule. However, this can be done anyway.
The fact is that using DENIAL of Permissions simplifies role management, since exceptions can be implemented.
Below is a diagram I made a long time ago that shows an RBAC model. I don’t have a schedule for claims, but you can imagine that these are just attributes attached to users, wherever they are. In addition, the chart does not show groups (I need to update it at some point).
Hope this helps.
This is a schematic of the RBAC described above.