Terri Shkuda Systems Analyst Migrating from User Rights Matrix to Role-Based Access Control (RBAC) Information and Transition Guide Terri Shkuda Systems Analyst

What is Role-Based Access Control (RBAC) Roles represent a type of user, e.g. Investigator. Roles are defined by a set of permissions. Each user is assigned a role. Users may only perform the actions defined by their role. In REDCap, roles control what a project user can do in REDCap (i.e., Project Design, Data Import, Create Records, Execute Data Quality Rules, etc.) Roles do NOT control what data/forms a project user can see/edit. This is controlled by the Data Entry Rights configured for each project user.

User Rights - Current Process User creates projects and adds users (with or without roles). User has access to User Rights tool. User requests move to Production status and provides a User Rights Matrix (URM). REDCap Administrator uses the URM to create roles and assign users to roles. User does not have access to User Rights Tool. To add, modify, delete users, User provides URM to REDCap Administrator for processing.

User Rights – Future Process (as of 11/17/16) User creates projects and adds users to a role configured in the REDCap system. User requests move to Production status and if not the data owner, provides a completed Delegation form. REDCap Administrator assigns delegation rights to user providing access to the User Rights Tool and User Access Dashboard. User (with delegate rights) can add/delete/modify a user’s rights in the User Rights tool (no need for REDCap Administrator intervention).

For Projects currently in Production Transition to New Process For Production projects, accessing the User Rights tool will not be automatic. For data owners/delegates, please click on the Contact REDCap Administrator button in their project and indicate the following in the subject line of the email: Transition my delegate access.

RBAC Plugin in Control Center Roles are configured in the Control Center by the REDCap Administrator. Current roles from User Rights Matrix are the same as RBAC roles. Future changes to roles will impact all projects. All rights are configured independent of a project’s feature availability.

Migrating Existing User Roles/Rights Migration is a one-time per project task. The warning box will disappear when all existing users have been migrated Existing user permissions are still in effect until a new role has been selected . The legacy role column is provided to allow for ease of migration. All legacy role names should be available in the new RBAC role list.

Converting Legacy Role to RBAC Once you select “Edit Rights” in the Warning box for a project user, you will be directed to this page to setup the project user’s new RBAC rights along with Data Entry Rights for your instruments. Additionally, you can setup an expiration date, Double Data Entry setting (if enabled)

New User Rights Page

Add New User This REDCap page now replaces the User Rights Matrix. All user assignments are done by the project staff with the delegate rights. Project and user-specific rights Form-level rights specific to each user

Who gets User Rights access? Only the Data Owner (e.g., PI) and delegates will have access to User Rights. The REDCap Administrator will check the Delegate box for the user once the delegation form has been submitted. Delegate rights allow the user to assign other users to rights on the project and maintain user access through the User Access Dashboard. Delegates cannot grant delegate rights to other users. The checkbox will be grayed out. All references to delegate rights apply to the data owner as well.

User Access Dashboard for Delegates and Data Owners only Only users with delegate rights will have access to the User Access Dashboard as seen on the My Project page. This Dashboard will allow delegates to manage the users on projects for which they have delegate rights.

User Access Dashboard Functions for Delegates and Data Owners only Delegate or Data Owner Only View by project, by user: API tokens Project expiration date Last time the user accessed the project Delete user from project Expire access from project by user There are also recommendations of changes available (see highlighted areas in red). See example on next slide.

Delegate or Data Owner Only