Role-based access control in Microservices - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to check if a user has the required role before accessing a service.

Microservices

if user.roles.__contains__([1]):
    allow_access()

Drag options to blanks, or click blank then click option'

A"admin"

Baccess

Croles

Duser.roles

Attempts:

3 left

💡 Hint

Common Mistakes

Using the variable name 'roles' instead of the role string.

Checking the entire roles list instead of a specific role.

The code checks if the user's roles include the string "admin" to allow access.

2fill in blank

medium

Complete the code to assign roles to a new user in the microservice.

Microservices

new_user.roles = [1]

Drag options to blanks, or click blank then click option'

A["guest"]

B"admin"

Croles

Duser.roles

Attempts:

3 left

💡 Hint

Common Mistakes

Assigning a single string instead of a list.

Using undefined variables like 'roles' without declaration.

Roles are assigned as a list of strings. Here, the new user is assigned the role "guest".

3fill in blank

hard

Fix the error in the code that checks if a user has the 'editor' role.

Microservices

if [1] in user.roles:
    grant_edit_permission()

Drag options to blanks, or click blank then click option'

Auser

Broles

Cuser.roles

D"editor"

Attempts:

3 left

💡 Hint

Common Mistakes

Checking if the entire roles list is in itself.

Using variable names instead of the role string.

The code should check if the string "editor" is in the user's roles list.

4fill in blank

hard

Fill both blanks to create a dictionary mapping roles to permissions.

Microservices

role_permissions = { [1]: [2] for role in roles_list }

Drag options to blanks, or click blank then click option'

Arole

B["read"]

Crole.upper()

D["write"]

Attempts:

3 left

💡 Hint

Common Mistakes

Using role.upper() as key which changes the role name.

Assigning a string instead of a list for permissions.

The dictionary maps each role to a list of permissions, here "read" permission.

5fill in blank

hard

Fill all three blanks to filter users who have the 'admin' role and create a list of their IDs.

Microservices

admin_ids = [user.[1] for user in users if '[2]' in user.[3]]

Drag options to blanks, or click blank then click option'

Aid

Badmin

Croles

Dname

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'name' instead of 'id' for user identifier.

Checking for 'admin' in wrong attribute.

Using variable names instead of string for role.

The code collects the 'id' of users whose 'roles' list contains the string 'admin'.

Practice

1. What is the main purpose of Role-Based Access Control (RBAC) in microservices?

easy

A. To encrypt data between microservices

B. To monitor network traffic for security threats

C. To assign permissions to users based on their roles

D. To deploy microservices automatically

Solution

1. Step 1: Understand RBAC concept

   RBAC assigns permissions to users based on their roles, simplifying access management.

2. Step 2: Identify RBAC purpose in microservices

   In microservices, RBAC controls who can access which service or API based on roles.

3. Final Answer:

   To assign permissions to users based on their roles -> Option C

4. Quick Check:

   RBAC = Role-based permission assignment [OK]

Hint: RBAC controls access by roles, not by encryption or deployment [OK]

Common Mistakes:

• Confusing RBAC with encryption
• Thinking RBAC monitors network traffic
• Assuming RBAC automates deployment

2. Which of the following is the correct way to represent a role in an RBAC system for microservices?

easy

A. {"service": "admin", "level": 5}

B. {"role": "admin", "permissions": ["read", "write"]}

C. {"user": "admin", "access": "full"}

D. {"permission": "admin", "role": "read"}

Solution

1. Step 1: Identify correct role structure

   A role should have a name and a list of permissions it grants.

2. Step 2: Match structure to options

   {"role": "admin", "permissions": ["read", "write"]} correctly shows a role with permissions as a list, matching RBAC design.

3. Final Answer:

   {"role": "admin", "permissions": ["read", "write"]} -> Option B

4. Quick Check:

   Role = name + permissions list [OK]

Hint: Roles have permissions list; user or service keys are incorrect here [OK]

Common Mistakes:

• Confusing user with role
• Using 'permission' as role name
• Assigning access level instead of permissions

3. Given this simplified RBAC check in a microservice:

def can_access(user_role, action):
    permissions = {
        "user": ["read"],
        "admin": ["read", "write", "delete"]
    }
    return action in permissions.get(user_role, [])

print(can_access("user", "delete"))

What is the output?

medium

A. None

B. True

C. KeyError

D. False

Solution

1. Step 1: Understand permissions dictionary

   The "user" role has only ["read"] permission, no "delete".

2. Step 2: Check if "delete" is in user permissions

   Since "delete" is not in ["read"], the function returns False.

3. Final Answer:

   False -> Option D

4. Quick Check:

   "delete" in user permissions = False [OK]

Hint: Check if action is in role's permission list [OK]

Common Mistakes:

• Assuming all actions allowed for user
• Expecting KeyError for missing keys
• Confusing True/False return values

4. A microservice uses this RBAC check:

def check_access(role, permission):
    role_permissions = {
        "editor": ["read", "write"],
        "viewer": ["read"]
    }
    return permission in role_permissions[role]

print(check_access("admin", "write"))

What is the problem and how to fix it?

medium

A. KeyError occurs; fix by using role_permissions.get(role, [])

B. SyntaxError due to missing colon; add colon after function

C. Returns False incorrectly; add "admin" role to dictionary

D. Returns True incorrectly; remove "write" from editor permissions

Solution

1. Step 1: Identify error cause

   Accessing role_permissions["admin"] causes KeyError because "admin" key is missing.

2. Step 2: Fix by safe dictionary access

   Use role_permissions.get(role, []) to return empty list if role missing, avoiding error.

3. Final Answer:

   KeyError occurs; fix by using role_permissions.get(role, []) -> Option A

4. Quick Check:

   Missing key causes KeyError; get() avoids it [OK]

Hint: Use get() to avoid KeyError on missing roles [OK]

Common Mistakes:

• Adding roles without permissions
• Confusing syntax errors with runtime errors
• Ignoring missing key errors

5. In a microservices architecture, where is the best place to enforce RBAC to ensure scalability and security?

hard

A. At the API Gateway before requests reach microservices

B. On the client side before sending requests

C. Only in the database layer with SQL permissions

D. Inside each microservice individually

Solution

1. Step 1: Consider scalability and security needs

   Enforcing RBAC centrally avoids duplication and reduces risk of inconsistent checks.

2. Step 2: Identify best enforcement point

   API Gateway is the central entry point, ideal for RBAC enforcement before microservices.

3. Final Answer:

   At the API Gateway before requests reach microservices -> Option A

4. Quick Check:

   Central RBAC at API Gateway = scalable & secure [OK]

Hint: Enforce RBAC centrally at API Gateway for best results [OK]

Common Mistakes:

• Enforcing RBAC only in microservices causes duplication
• Relying on client-side enforcement is insecure
• Using database permissions alone misses API-level control