Roles and Permissions (RBAC)

StifleR RBAC is built from two separate concepts:

• Rules — define who matches. A rule contains a claim matcher: either a Windows AD group or an OIDC claim. Rules are managed under Administration > Rules and can be reused across multiple roles.

• Roles — define what matched users can do. A role is a named grouping with a set of permissions. Rules are assigned to roles to determine membership.

When a user authenticates, StifleR checks which rules match their identity, finds all roles those rules belong to, unions the permissions across those roles, and applies the result for the session. Changes take effect on the user's next login.

Create a rule

Rules define the claim that identifies a user or group. Create rules first, then assign them to roles.

Go to Administration > Rules and click New rule.

Windows AD group

1. Enter a Name for the rule (e.g. AD – Network Admins).

2. Set Claim type to Windows.

3. Set Claim name to the fully qualified AD group name: DOMAIN\GroupName.

4. Click Save.

OIDC (Entra ID / Ping Identity)

1. Enter a Name for the rule (e.g. Entra – Network Admins).

2. Set Claim type to External.

3. Set Claim name to the claim type your identity provider sends — typically groups.

4. Set Claim id to the claim value for the group — for Entra ID this is the group's object ID (a GUID, not the display name).

5. Click Save.

Entra ID tip: To find a group's object ID, go to Entra ID > Groups, open the group, and copy the Object ID field. To confirm the claim is present in the token, sign in as a test user and inspect the token at jwt.ms . If the groups claim is missing, group claims must be enabled in the app registration under Token configuration.

Create a role

1. Go to Administration > Roles and click New role.

2. Enter a descriptive name, for example Network Admins or DeployR – Read Only.

3. Click Save.

Assign rules to the role

1. In the Role list, expand the role by clicking the arrow next to it.

2. Click Add rule.

3. Select the rule you created and confirm.

A role can have multiple rules. A user is included in the role if they match any of the assigned rules.

Assign permissions

1. Open the role editor for the role.

2. You will see a matrix of feature sets, with subjects as rows and Read / Write / Delete as columns.

3. Check the verbs you want to grant for each subject.

4. Click Save.

Editing a role

To change who belongs to a role, expand it in the Role list and add or remove rules.

To change what the role can do, open the role editor and update the permissions matrix.

Deleting a role

Go to System > Roles, select the role, and click Delete. Affected users lose the permissions that role granted on their next login.

Assigning permissions

In the role editor you will see a matrix of feature sets, each with its subjects as rows and Read / Write / Delete as columns.

Check the verbs you want to grant for each subject:

• Read — view data, navigate to pages

• Write — create and modify records

• Delete — remove records

Subjects within a feature set are independent — you can grant BootImage: Read+Write without granting TaskSequence access at all. A user with no permissions for a feature set cannot navigate to any of its pages.

Feature set visibility: If a feature set is unlicensed or disabled (via the Features page), all permissions under it are denied regardless of role configuration. Subjects for unlicensed features will appear greyed out in the matrix.

Permission reference by feature set

Administration

Controls access to system configuration.

Subject	Read	Write	Delete
License	View license details	—	—
Feature	View feature state	Enable/disable features	—
User	View users and sessions	—	—
Rule	View claim rules	Create/edit rules	Delete rules
Role	View roles	Create/edit roles	Delete roles
Policy	View policies	Create/edit policies	Delete policies
InfrastructureService	View infrastructure services	—	—
ServerHealth	View server health	—	—
NetworkGroupTemplate	View templates	Create/edit templates	Delete templates

Devices

Subject	Read	Write	Delete
Device	View clients, search, hardware info, history	Set power level	Delete clients
Elevation	View local admins, sessions, elevation stats	—	—

Networks

Subject	Read	Write	Delete
Area	View areas	Create/edit areas	Delete areas
Location	View locations	Create/edit locations	Delete locations
NetworkGroup	View network groups	Create/edit groups, Resume/Suspend/Cancel, WoL	Delete network groups
Network	View networks	Create/edit networks, Resume/Suspend/Cancel, WoL, Reassign	Delete networks

BandwidthManagement

Subject	Read	Write	Delete
ThrottlingPolicy	View policies	Create/edit policies	Delete policies
BranchCacheSettings	View settings	Modify settings	—
DeliveryOptimizationSettings	View settings	Modify settings	—
Traffic	View traffic data	—	—

DeployR

Subject	Read	Write	Delete
BootImage	View boot images	Create/edit boot images	Delete boot images
TaskSequence	View task sequences	Create/edit task sequences	Delete task sequences
StepDefinition	View step definitions	Create/edit step definitions	Delete step definitions
ApplicationContent	View application content	—	—
OsContent	View OS content	—	—
DriverPackContent	View driver pack content	—	—
OtherContent	View other content	—	—

CacheManagement

Subject	Read	Write	Delete
Usage	View cache usage reporting	—	—

OsdDeployments

Subject	Read	Write	Delete
Osd	View OSD deployments	Create/edit OSD deployments	Delete OSD deployments
Autopilot	View Autopilot deployments	Create/edit Autopilot deployments	Delete Autopilot deployments
Generic	View generic deployments	Create/edit generic deployments	Delete generic deployments

CacheR

Subject	Read	Write	Delete
Packages	View packages	—	—
DistributionPoints	View distribution points	—	—
TrackedContent	View tracked content	—	—

RemoteR

Note: RemoteR permissions control access to individual remote tools. Users without the relevant permission will see each tool disabled with a "No permission" message. Accessing the client page itself requires Devices.Device read permission.

Testing a role

To test without logging out of your admin session, open a separate browser profile or private window and sign in as the test user. For Windows Integrated Auth, you can also launch Edge under a different identity from a command prompt:

**runas /user:DOMAIN\testuser msedge.exe