Text Generation WebUI RBAC ABAC Policy —

Text Generation WebUI + RBAC/ABAC

Text Generation WebUI oobabooga LLM RBAC ABAC Access Control Policy Role Permission Attribute Security Production

Access Model	Based On	Flexibility	Complexity	Best For
RBAC	Role ของ User	กลาง	ต่ำ-กลาง	องค์กรทั่วไป Role ชัดเจน
ABAC	Attribute หลายมิติ	สูงมาก	สูง	องค์กรใหญ่ Policy ซับซ้อน
RBAC+ABAC	Role + Attribute	สูงมาก	กลาง-สูง	แนะนำ ผสมข้อดีทั้งสอง
ACL	List per Resource	ต่ำ	ต่ำ (แต่ Scale ยาก)	ระบบเล็ก Resource น้อย

API Security

# === API Gateway with Auth === # Nginx reverse proxy with auth # server { # listen 443 ssl; # server_name llm.internal.company.com; # # ssl_certificate /etc/ssl/certs/llm.pem; # ssl_certificate_key /etc/ssl/private/llm.key; # # # Rate limiting # limit_req_zone $binary_remote_addr zone=llm:10m rate=10r/m; # # location /api/v1/generate { # # Auth check # auth_request /auth; # auth_request_set $user_role $upstream_http_x_user_role; # # # Rate limit based on role # limit_req zone=llm burst=5 nodelay; # # proxy_pass http://localhost:5000; # proxy_set_header X-User-Role $user_role; # proxy_read_timeout 120s; # } # # location = /auth { # internal; # proxy_pass http://localhost:8080/verify; # proxy_pass_request_body off; # proxy_set_header Content-Length ""; # proxy_set_header X-Original-URI $request_uri; # proxy_set_header Authorization $http_authorization; # } # } @dataclass class SecurityLayer: layer: str implementation: str protects_against: str config: str layers = [ SecurityLayer("Authentication", "JWT Token / API Key per User", "Unauthorized Access", "Authorization: Bearer "), SecurityLayer("Authorization (RBAC)", "Role check per endpoint", "Privilege Escalation", "X-User-Role header from auth service"), SecurityLayer("Rate Limiting", "Nginx limit_req per role", "DoS, Resource Abuse", "User: 10/min, Dev: 100/min, Admin: 1000/min"), SecurityLayer("Input Validation", "Max tokens, prompt length, banned words", "Prompt Injection, Resource Abuse", "max_tokens: 2048, max_prompt: 4096 chars"), SecurityLayer("Audit Logging", "Log ทุก Request + Response metadata", "Compliance, Forensics", "ELK Stack / CloudWatch Logs"), SecurityLayer("Network", "VPN / Internal Network Only", "External Attack", "Nginx allow 10.0.0.0/8; deny all;"), ] print("=== Security Layers ===") for s in layers: print(f" [{s.layer}] {s.implementation}") print(f" Protects: {s.protects_against}") print(f" Config: {s.config}")