casbin / jcasbin

An authorization library that supports access control models like ACL, RBAC, ABAC in Java
https://casbin.org
Apache License 2.0
2.4k stars 464 forks source link

Super administrator's authority is invalid when using priority matching #192

Closed shink closed 3 years ago

shink commented 3 years ago

problem

When using the following configuration, two error occurs.

  1. Super administrator's authority is invalid when using priority matching
  2. When using an adapter such as jdbcAdapter, the first time the result was wrong, but everything is correct after that

model

[request_definition]
r = sub, obj, act

[policy_definition]
p = priority, sub, obj, act, eft

[role_definition]
g = _, _

[policy_effect]
e = priority(p.eft) || deny

[matchers]
m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act || r.sub == 'root'

policy

p, 10, data1_deny_group, data1, read, deny
p, 10, data1_deny_group, data1, write, deny
p, 10, data2_allow_group, data2, read, allow
p, 10, data2_allow_group, data2, write, allow

p, 1, alice, data1, write, allow
p, 1, alice, data1, read, allow
p, 1, bob, data2, read, deny

g, bob, data2_allow_group
g, alice, data1_deny_group
g, tony, data1_deny_group

request

alice, data1, write    // Expected: true, Actual: true
bob, data2, read    // Expected: false, Actual: false

root, data1, write    // Expected: true, Actual: false
root, data2, read    // Expected: true, Actual: false
root, data1, read    // Expected: true, Actual: false

All user root requests should be allowed.

shink commented 3 years ago

@mango-6bd Please confirm whether the above is consistent with what you have described.

mango-6bd commented 3 years ago

Yes,consistent

Dzy-yubai commented 3 years ago

Why did I test correctly in the latest version of JCasbin

shink commented 3 years ago

@Dzy-yubai I will confirm again.

hsluoyz commented 3 years ago

@shink yeah, if there's no issue actually, we will close here.

shink commented 3 years ago

@Dzy-yubai Thank you for your reminder.

@mango-6bd I tested it with the latest version of jcasbin(1.10.0), but this error did not appear. Please use the latest version of jcasbin to confirm.