search

cesanta / docker_auth

Authentication server for Docker Registry 2
Apache License 2.0
1.28k stars 305 forks source link

Support casbin as the authorization backend #178

Open hsluoyz opened 7 years ago

hsluoyz commented 7 years ago

Casbin is an authorization library that supports models like ACL, RBAC, ABAC.

Related to RBAC, casbin has several advantages:

  1. roles can be cascaded, aka roles can have roles.
  2. support resource roles, so users have their roles and resource have their roles too. role = group here.
  3. the permission assignments (or policy in casbin's language) can be persisted in files or database (MySQL and Cassandra).

And you can even customize your own access control model, for example, mix RBAC and ABAC together by using roles and attributes at the same time. It's very flexible.

I think it's more powerful than the current ACL way, what do you think? Thanks.

rojer commented 7 years ago

this seems interesting. ideally, with backward compatible configuration, but if it's compelling enough, we can consider full replacement and cutting a v2. as always, providing implementation will speed up adoption :) absent that, you will need to wait until i have spare cycles, of which i have very few (this is essentially a side project for me).

hsluoyz commented 7 years ago

Hi @rojer ,

Thanks for your reply! I have made a PR about adding Casbin authz way: https://github.com/cesanta/docker_auth/pull/182

The original auth way like ACL is a little complicated, like the label. I don't know if I understand it correctly, please advise.

And I have also added the test. In the test I demonstrated the usage of RBAC and admin. So a user can inherit the permissions from a role, and the admin user will have all the permissions to do anything. These show the flexibility of Casbin.

Let me know if there's any question:)