Access Control, RBAC & SSO
Relevant source files
The following files were used as context for generating this wiki page:
Access control in n8n governs how users interact with resources like workflows, credentials, and projects. The system uses Role-Based Access Control (RBAC) to define permissions via scopes and Single Sign-On (SSO) for external identity management.
The n8n team manages core identity and access management (IAM) systems in-house to prevent unauthorized data exposure. Security-related features prioritize non-disruptive builder experiences while maintaining strict enforcement layers across the backend and node execution boundaries.
Sources: CONTRIBUTING.md:387-393, AGENTS.md:237-246
Role-Based Access Control (RBAC)
n8n implements RBAC through a combination of roles and project-level relations. Roles are defined by "scopes" which are granular slugs representing specific actions on resources.
Permission Scopes and Roles
Scopes grant specific capabilities such as read, list, create, update, delete, and share for different resource types. Roles aggregate these scopes to define user abilities within a project.
Sources: packages/cli/test/integration/access-control/resource-access-matrix.test.ts:54-94
| Role Type | Common Scopes | Description |
|---|---|---|
| Workflow Read-Only | workflow:read, workflow:list | Allows viewing and listing workflows only. |
| Workflow All Operations | workflow:create, workflow:read, workflow:update, workflow:delete, workflow:list, workflow:share, workflow:execute | Full CRUD and execution access for workflows. |
| Credential Read-Only | credential:read, credential:list | Allows viewing and listing credentials only. |
| Credential All Operations | credential:create, credential:read, credential:update, credential:delete, credential:list | Full CRUD access for credentials. |
Sources: packages/cli/test/integration/access-control/resource-access-matrix.test.ts:54-94
Resource Access Logic
Access is enforced at the API endpoint level. If a user lacks a specific scope (e.g., workflow:create), the server returns a 400 or 403 Forbidden error. For example, a user with only workflow:read cannot perform a PATCH or DELETE on a workflow.
Sources: packages/cli/test/integration/access-control/resource-access-matrix.test.ts:133-167
The following diagram illustrates the flow of a user request through the RBAC validation layer:
The diagram shows how the system validates authentication, role-based scopes, and project-specific ownership before executing a requested action.
Sources: packages/cli/test/integration/access-control/resource-access-matrix.test.ts:133-167, packages/cli/src/public-api/v1/openapi.decorator-routes.generated.yml
Single Sign-On (SSO) & External Identity
n8n supports SSO through OIDC and SAML protocols. These configurations allow organizations to delegate authentication to external identity providers.
SSO Configuration Endpoints
The public API provides routes for managing OIDC and SAML settings. These are handled via the settings/sso path.
Sources: packages/cli/src/public-api/v1/openapi.decorator-routes.generated.yml:185-195, packages/cli/src/public-api/v1/openapi.decorator-routes.generated.yml:204-208
| Endpoint | Method | Description |
|---|---|---|
/settings/sso/oidc | GET / PUT | Manages OIDC configuration settings. |
/settings/sso/saml | GET / PUT | Manages SAML configuration settings. |
/settings/ldap | GET / PUT | Manages LDAP configuration and sync. |
Sources: packages/cli/src/public-api/v1/openapi.decorator-routes.generated.yml:157-167, packages/cli/src/public-api/v1/openapi.decorator-routes.generated.yml:185-208
Project & Team Access Management
Access is further segmented by "Projects." Users are linked to projects through the ProjectRelation entity, which assigns them a specific role slug within that project context.
Team Projects
Team projects allow multiple users to collaborate. Owners can add users to projects and change their roles.
Sources: packages/cli/test/integration/access-control/resource-access-matrix.test.ts:31-50, packages/cli/src/public-api/v1/openapi.decorator-routes.generated.yml:135-147
The ER diagram represents the relationship between users, their assigned roles within specific projects, and the resources (workflows/credentials) owned by those projects.
Sources: packages/cli/test/integration/access-control/resource-access-matrix.test.ts:31-110
Security Policies
n8n provides configuration for security policies at both the instance and project levels. This includes policies for node-type and credential-type, allowing administrators to restrict which nodes or credentials can be used.
Sources: packages/cli/src/public-api/v1/openapi.decorator-routes.generated.yml:19-40, packages/cli/src/public-api/v1/openapi.decorator-routes.generated.yml:111-132
Audit & Log Streaming
For enterprise compliance, the system includes auditing and log streaming capabilities.
- Audit Logs: The
/auditendpoint generates logs for system-wide activities. - Log Streaming: Administrators can configure destinations (like Syslog or external SIEMs) for event streaming.
- Event Bus: An internal event bus facilitates decoupled communication for activity events.
Sources: packages/cli/src/public-api/v1/openapi.decorator-routes.generated.yml:4-6, packages/cli/src/public-api/v1/openapi.decorator-routes.generated.yml:168-182, AGENTS.md:158-161
Conclusion
The Access Control, RBAC, and SSO systems provide a layered security model. RBAC ensures granular permission management via scopes and project relations, while SSO integration enables secure, centralized authentication. These components work together to protect workflows and sensitive credentials across both personal and team environments.