Passer au contenu principal

Supported Models

Casbin supports the following access control models and patterns. If you are not sure which one you need, start with Choosing an access control model.

  1. ACL (Liste de contrôle d'accès)
  2. ACL avec superutilisateur
  3. ACL without users — For systems without authentication or user identity (e.g. API-only or device access).
  4. ACL without resources — When permissions apply to resource types rather than specific instances (e.g. "write-article", "read-log").
  5. RBAC (Contrôle d'accès basé sur les rôles)
  6. RBAC with resource roles — Both users and resources can have roles (or group memberships).
  7. RBAC with domains/tenants — Users can have different roles in different domains or tenants.
  8. ABAC (Attribute-Based Access Control) — Uses attributes (e.g. resource.Owner) in rules.
  9. PBAC (Policy-Based Access Control) — Authorization is driven by rule-based policies for dynamic, context-aware decisions.
  10. BLP (Bell–LaPadula) — Formal model with security labels and clearances.
  11. Biba — Integrity model that restricts information flow to prevent unauthorized changes.
  12. LBAC (Lattice-Based Access Control) — Combines confidentiality and integrity in a lattice-based framework.
  13. OrBAC (Organisation-Based Access Control) — RBAC extended with abstraction layers for multi-organization policies.
  14. UCON (Usage Control) — Covers ongoing authorization, mutable attributes, obligations, and conditions.
  15. RESTful — Path patterns (e.g. /res/*, /res/:id) and HTTP methods (GET, POST, PUT, DELETE).
  16. IP Match — Match by IP address or CIDR for network-level control.
  17. Deny-override — Both allow and deny policies; deny overrides allow.
  18. Priority — Policy rules are ordered (e.g. like firewall rules); first match wins.

أمثلة​

ModèleFichier de modèleFichier de politique
ACLbasic_model.confbasic_policy.csv
ACL avec superutilisateurbasic_with_root_model.confbasic_policy.csv
ACL sans utilisateursbasic_without_users_model.confbasic_without_users_policy.csv
ACL sans ressourcesbasic_without_resources_model.confbasic_without_resources_policy.csv
RBACrbac_model.confrbac_policy.csv
RBAC avec des rôles de ressourcesrbac_with_resource_roles_model.confrbac_with_resource_roles_policy.csv
RBAC avec domaines/locatairesrbac_with_domains_model.confrbac_with_domains_policy.csv
ReBACrebac_model.confrebac_policy.csv
ABACabac_model.confN/A
BLPblp_model.confN/A
Bibabiba_model.confN/A
LBAClbac_model.confN/A
OrBACorbac_model.conforbac_policy.csv
IP Matchipmatch_model.confipmatch_policy.csv
RESTfulkeymatch_model.confkeymatch_policy.csv
Refus-prioritairerbac_with_not_deny_model.confrbac_with_deny_policy.csv
Autoriser-et-refuserrbac_with_deny_model.confrbac_with_deny_policy.csv
Prioritépriority_model.confpriority_policy.csv
Priorité explicitepriority_model_explicitpriority_policy_explicit.csv
Priorité-Sujetsubject_priority_model.confsubject_priority_policyl.csv

Comments are powered by giscus and GitHub Discussions. They load from giscus.app and GitHub only after you click the button below.