search

ChiralBehaviors / Ultrastructure

Ultrastructure as a Service
GNU Affero General Public License v3.0
6 stars 2 forks source link

Support jCasbin as the authorization backend #259

Open veotax opened 6 years ago

veotax commented 6 years ago

jCasbin is an authorization library that supports models like ACL, RBAC, ABAC.

Related to RBAC, casbin has several advantages:

  1. roles can be cascaded, aka roles can have roles.
  2. support resource roles, so users have their roles and resource have their roles too. role = group here.
  3. the permission assignments (or policy in casbin's language) can be persisted in files or database.
  4. multiple models like ACL, BLP, RBAC, ABAC, RESTful are supported.

And you can even customize your own access control model, for example, mix RBAC and ABAC together by using roles and attributes at the same time. It's very flexible.

I saw there's a RBAC mechanism already in Ultrastructure, but I think it can be extended to more powerful and flexible models like RBAC and ABAC through the integration of jCasbin. What do you think? Thanks.

Hellblazer commented 6 years ago

Well, sure. It's a matter of the interface. I don't see any reason why the model couldn't be extended to encompass such, given the model of RBAC.

I'm currently in the middle of a lot of fundamental refactoring, so I can't even attempt to do a quick sketch... However, I'll try to attempt this when I'm done with the property modeling.

Thanks!