[id='configuring-cache-authorization_{context}']
= Configuring caches with security authorization

Add security authorization to caches to enforce role-based access control (RBAC).
This requires {brandname} users to have a role with a sufficient level of permission to perform cache operations.

.Prerequisites

* Create {brandname} users and either grant them with roles or assign them to groups.

.Procedure

. Open your {brandname} configuration for editing.
. Add a `security` section to the configuration.
. Specify roles that users must have to perform cache operations with the `authorization` element.
+
You can implicitly add all roles defined in the Cache Manager or explicitly define a subset of roles.
. Save the changes to your configuration.

[discrete]
== Implicit role configuration

The following configuration implicitly adds every role defined in the Cache Manager:

.XML
[source,xml,options="nowrap",subs=attributes+,role="primary"]
----
include::xml/authorization_roles_implicit.xml[]
----

.JSON
[source,json,options="nowrap",subs=attributes+,role="secondary"]
----
include::json/authorization_roles_implicit.json[]
----

.YAML
[source,yaml,options="nowrap",subs=attributes+,role="secondary"]
----
include::yaml/authorization_roles_implicit.yaml[]
----

[discrete]
== Explicit role configuration

The following configuration explicitly adds a subset of roles defined in the Cache Manager.
In this case {brandname} denies cache operations for any users that do not have one of the configured roles.

.XML
[source,xml,options="nowrap",subs=attributes+,role="primary"]
----
include::xml/authorization_roles_explicit.xml[]
----

.JSON
[source,json,options="nowrap",subs=attributes+,role="secondary"]
----
include::json/authorization_roles_explicit.json[]
----

.YAML
[source,yaml,options="nowrap",subs=attributes+,role="secondary"]
----
include::yaml/authorization_roles_explicit.yaml[]
----
