Access Control Models

📄️ Choosing a Model

ACL, RBAC, ABAC, ReBAC and PBAC compared on one example: what each decides on, strengths, weaknesses, when to choose it, and how to combine RBAC with ABAC.

📄️ Supported Models

Access control models supported by Casbin - ACL, RBAC, RBAC with domains, ABAC, ReBAC, PBAC, BLP, Biba, LBAC, OrBAC, UCON, RESTful, IP match, deny-override and priority.

📄️ Model Syntax

Casbin model syntax reference - request, policy, role and effect definitions and matchers in CONF files, with operators and examples.

📄️ Effector

The Casbin Effector interface combines the effects of all matching policy rules into one decision, for allow-override, deny-override, priority and custom effects.

📄️ Functions

Built-in Casbin matcher functions - keyMatch, keyMatch2-5, regexMatch, ipMatch, globMatch and key extraction - and how to register your own custom functions.

📄️ ReBAC

What relationship-based access control (ReBAC) is, how it relates to Google Zanzibar, how it differs from RBAC and ABAC, and how to model user-resource relationships in Casbin.

What attribute-based access control (ABAC) is, how it differs from RBAC, and how to write ABAC rules in Casbin: compare user, resource and environment attributes in the matcher or store conditions as policy.

📄️ PBAC

What policy-based access control (PBAC) is, how it differs from ABAC and RBAC, and how to store rule expressions as policy in Casbin and evaluate them at runtime with eval().

🗃️ MAC

3 items

📄️ OrBAC

Implement organisation-based access control (OrBAC) in Casbin - roles, activities and views mapped to concrete users, actions and objects per organization.

📄️ Priority Model

Resolve conflicting rules with the Casbin priority model - implicit priority by policy order, explicit priority fields, and role-hierarchy-based priority.