https://casbin.org/docs/zh-CN/tutorials

Model

在 Casbin 中, 访问控制模型被抽象为基于 PERM (Policy, Effect, Request, Matcher) 的一个文件。
PERM模式由四个基础（策略、效果、请求、匹配）组成，描述了资源与用户之间的关系。

  1. # Request definition
  2. [request_definition]
  3. r = sub, obj, act
  5. # Policy definition
  6. [policy_definition]
  7. p = sub, obj, act
  9. # Policy effect
  10. [policy_effect]
  11. e = some(where (p.eft == allow))
  13. # Matchers
  14. [matchers]
  15. m = r.sub == p.sub && r.obj == p.obj && r.act == p.act

Request
定义请求参数。要求至少有一个主题(subject 访问实体)，对象(object 访问资源)，动作(action 访问方法)
例如r = {sub, obj, act}
Policy
定义访问策略的模型。实际上，它定义了Policy规则文档中字段的名称和顺序。
例如p = {sub, obj, act}或者p = {sub, obj, act, eft}
Matcher
request和policy的匹配关系
例如 m = r.sub == p.sub && r.obj == p.obj && r.act == p.act
Effect
对匹配结果的再次逻辑组合判断
例如e = some(where(p.eft == allow))

RBAC

  1. [role_definition]
  2. g = _, _
  3. g2 = _, _

[role_definition]是为RBAC角色继承关系的定义。users和resources可以有角色和他们的继承关系。

casbin在policy中存储着实际的 用户-角色（或资源-角色）,例如

  1. p, data2_admin, data2, read
  2. g, alice, data2_admin
  3. //表示alice是data2_admin角色的一个成员
  4. //alice可以是一个用户、资源或者是权限

在matcher中，你应该检查这个权限

  1. [matchers]
  2. m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

If A has role B, B has role C, then A has role C.

use pattern matching in RBAC

  1. p, alice, book_group, read
  2. g, /book/1, book_group
  3. g, /book/2, book_group
  1. g, /book/:id, book_group
  1. p, admin, domain1, data1, read
  2. p, admin, domain1, data1, write
  3. p, admin, domain2, data2, read
  4. p, admin, domain2, data2, write
  6. g, alice, admin, *
  7. g, bob, admin, domain2

In this example, we want alice to read and write data in domain1 and domain2, pattern matching* in gmakes alice have the access to two domains.

Role definition with domains tenants

  1. [role_definition]
  2. g = _, _, _
  1. p, admin, tenant1, data1, read
  2. p, admin, tenant2, data2, read
  4. g, alice, admin, tenant1
  5. g, alice, user, tenant2
  1. [matchers]
  2. m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && r.obj == p.obj && r.act == p.act

It means admin role in tenant1 can read data1. And alice has admin role in tenant1, and has user role in tenant2. So she can read data1. However, since alice is not an admin in tenant2, she cannot read data2.

ABAC

ABAC is Attribute-Based Access Control

  1. type testResource struct {
  2.     Name  string
  3.     Owner string
  4. }
  1. [request_definition]
  2. r = sub, obj, act
  4. [policy_definition]
  5. p = sub, obj, act
  7. [policy_effect]
  8. e = some(where (p.eft == allow))
  10. [matchers]
  11. m = r.sub == r.obj.Owner

We use r.obj.Owner instead of r.obj in the matcher. The r.obj passed in the Enforce() function will be a struct or class instance instead of string.我们在匹配器中使用r.obj.owner而不是r.obj。在Enforce()函数中传递的r.obj将是一个结构或类实例，而不是字符串。

Super Admin

  1. [request_definition]
  2. r = sub, obj, act
  4. [policy_definition]
  5. p = sub, obj, act
  7. [policy_effect]
  8. e = some(where (p.eft == allow))
  10. [matchers]
  11. m = r.sub == p.sub && r.obj == p.obj && r.act == p.act || r.sub == "root"

Model存储

从.conf文件中加载

e := casbin.NewEnforcer("examples/rbac_model.conf", "examples/rbac_policy.csv")

从代码加载

  1. import (
  2.     "github.com/casbin/casbin/v2"
  3.     "github.com/casbin/casbin/v2/model"
  4.     "github.com/casbin/casbin/v2/persist/file-adapter"
  5. )
  7. // 从Go代码初始化模型
  8. m := model.NewModel()
  9. m.AddDef("r", "r", "sub, obj, act")
  10. m.AddDef("p", "p", "sub, obj, act")
  11. m.AddDef("g", "g", "_, _")
  12. m.AddDef("e", "e", "some(where (p.eft == allow))")
  13. m.AddDef("m", "m", "g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act")
  15. // 从CSV文件adapter加载策略规则
  16. // 使用自己的 adapter 替换。
  17. a := fileadapter.NewAdapter("examples/rbac_policy.csv")
  19. // 创建enforcer
  20. e := casbin.NewEnforcer(m, a)

从字符串中加载

  1. import (
  2.     "github.com/casbin/casbin/v2"
  3.     "github.com/casbin/casbin/v2/model"
  4. )
  6. // 从字符串初始化模型
  7. text :=
  8. `
  9. [request_definition]
  10. r = sub, obj, act
  12. [policy_definition]
  13. p = sub, obj, act
  15. [role_definition]
  16. g = _, _
  18. [policy_effect]
  19. e = some(where (p.eft == allow))
  21. [matchers]
  22. m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act
  23. `
  24. m, _ := model.NewModelFromString(text)
  26. // 从CSV文件adapter加载策略规则
  27. // 使用自己的 adapter 替换
  28. a := fileadapter.NewAdapter("示例/rbac_policy.csv")
  30. // 创建执行者。
  31. e := casbin.NewEnforcer(m, a)

Policy存储

从csv文件和数据库载入两种方式
https://casbin.org/docs/zh-CN/policy-storage

  1. p, alice, data1, read
  2. p, bob, data2, write
  3. p, data2_admin, data2, read
  4. p, data2_admin, data2, write
  5. g, alice, data2_admin

image.png