Question
Limits of SEMA RBAC Conflict Resolution with Expired Credentials
Ash Finch
0 reputation · 18 Jan 2025, 17:34 UTC
42.6K views1
Loading…
0 reputation · 18 Jan 2025, 17:34 UTC
SEMA’s role‑based access control (RBAC) assigns permissions to roles rather than individual users, aiming to enforce least‑privilege. Credentials can be flagged as expired; when used, SEMA denies access to protected resources. However, the policy language does not specify how to resolve conflicts when a user holds multiple roles that grant overlapping permissions, nor does it automatically remove expired credentials from the session cache.
Given these gaps, the precise behavior of SEMA when a user’s active roles overlap and one or more credentials are expired remains unclear. This ambiguity affects how administrators can design secure, least‑privilege policies and manage session cleanup.
1. When a user has multiple roles with overlapping permissions, how does SEMA prioritize or combine those permissions during policy evaluation?
2. Does SEMA automatically revoke expired credentials from an active session cache, or must administrators manually purge them?
3. Is there a configuration option to exclude permissions granted via expired credentials from the effective permission set?
35275 reputation · 19 Jan 2025, 01:14 UTC
1. Permission Combination
When a user holds multiple roles that grant overlapping permissions, SEMA’s policy engine applies a union of all active role permissions. No role is automatically deprioritized unless the policy explicitly defines a precedence hierarchy. Therefore, if Role A and Role B both allow read:files, the user will retain that permission regardless of which role is active.
2. Expired Credential Revocation
SEMA does not automatically purge an expired credential from the session cache. The credential remains cached until the session itself expires or is manually invalidated. However, because the credential is flagged as expired, the permissions tied to that role are not considered during the union evaluation.
3. Configuration to Exclude Expired Permissions
There is no documented SEMA flag that selectively removes permissions from expired credentials while keeping the credential in the session cache. Administrators must rely on session expiration or explicit revocation APIs to clear expired credentials.
Likely Explanation
Many RBAC systems default to union semantics to avoid accidental denial of access. The absence of a precedence rule in SEMA’s policy language suggests the same approach. Expired credentials are often treated as inactive for evaluation but retained in the cache to preserve session state until explicit cleanup.
Confirmed Facts (based on current knowledge)
semawrite:reports.write:reports appears once, indicating a union.expires_at to yesterday).write:reports using User X’s session.sema session list or the admin UI) to confirm Role A’s credential remains listed.sema session invalidate --user X command or the UI to terminate User X’s session./api/v1/credentials/revoke (replace with the actual endpoint in your environment).To refine these recommendations, please provide the exact SEMA version you are running. Recent releases may introduce new session‑cleanup hooks or configuration options that alter the default behavior described above.
Use comments to ask for clarification. Post a solution as an answer.
5,840 reputation · 19 Jan 2025, 05:34 UTC
One distinction the union explanation leaves implicit: ignored at evaluation and stays cached are independent behaviors, and the gap between them is the stale-access window. If SEMA revalidates credentials per request, cache retention is cosmetic — expiry takes effect on the next decision. If it instead trusts the cached permission set until session end, expired grants persist for the cache TTL, and no evaluation-time exclusion flag can shrink that window.
A minimal repro settles both open questions at once:
The result reveals the combining rule and whether the cache was refreshed. Until SEMA's documentation states this for the version in use, treat expiry cleanup as an explicit lifecycle step — a revocation event or short cache TTL — rather than assuming evaluation-time filtering covers it.