casbin/casbin

Features

• Attribute-Based Access Control - Provides a flexible authorization engine that enforces role-based, attribute-based, and relationship-based access control models.
• Authorization Middleware - Integrates with web frameworks and API gateways to intercept requests and validate security policies before processing.
• Access Control Models - Configures custom request parameters, policy structures, and evaluation logic to enforce specific authorization requirements across diverse application environments.
• Policy Enforcement Engines - Provides a framework for evaluating complex security rules against subjects, resources, and actions to determine access permissions in real-time.
• Action Resolution Policies - Evaluates requests against defined models and rules to determine if a subject is permitted to perform an action on a resource.
• Policy-Based Access Control - Decouples authorization logic from application code using a configuration-driven engine that interprets access rules at runtime.
• Role-Based Access Control - Evaluates access requests by checking if a subject possesses the required role, including transitive and hierarchical relationships.
• Conditional Access Evaluators - Evaluates dynamic logic alongside role assignments to restrict or permit actions based on runtime context or specific attributes.
• Authorization Policies - Stores access control rules in external files or databases and loads, saves, adds, or removes policies dynamically.
• Attribute-based Access Controls - Evaluates authorization requests against diverse security patterns including role-based, attribute-based, and lattice-based models.
• Multi-Tenant Identity Management - Isolates authorization rules by domain or tenant to ensure secure, scoped permission management in distributed architectures.
• Access Control and Authorization - Checks whether a subject is authorized to perform a specific action on a resource by matching requests against defined models and rules.
• Middleware - Hooks authorization logic into web frameworks and API gateways to intercept requests.
• Request Interception Middleware - Intercepts incoming requests at the application or infrastructure layer to validate access rights before executing protected operations.
• Data Storage Adapters - Connects the authorization engine to diverse persistent backends through a standardized adapter interface.
• Service Meshes - Intercepts network requests within a service mesh architecture to verify permissions before routing traffic between microservices.
• Domain-Based Access Controls - Configures access control to evaluate permissions within specific organizational scopes or tenants, supporting wildcard assignments across domains.
• Domain-Scoped Permissions - Enables domain-scoped permission management to control access across multi-tenant environments.
• Access Control Policies - Persists authorization rules in external storage backends to maintain consistent access control across application restarts.
• Relationship-Based Access Controls - Evaluates authorization requests by traversing relationships between users, resources, and types to determine access.
• Organizational Structure Management - Restricts access based on organizational structures and roles to ensure permissions align with hierarchical business units.
• Identity Provider Connections - Verifies user identities by mapping external authentication platform data to internal authorization rules.
• Multi-Tenant Security - Isolates access policies by domain or tenant to ensure secure, scoped permission management.
• Policy Outcome Aggregators - Combines multiple policy outcomes into a single allow or deny result based on defined logic like allow-override or deny-override.
• Policy Enforcement Engines - Intercepts cluster resource requests and evaluates them against declarative access control rules without custom webhook code.
• Conditional Access Rules - Applies logical conditions and matching functions to role assignments to determine permissions based on dynamic attributes.
• Pattern-Based Role Matching - Assign permissions using flexible pattern matching to simplify the management of large or dynamic sets of roles and users.
• Tab Access Restrictions - Synchronizes authorization rules to client-side applications to restrict user interface elements based on defined permissions.
• Role-Based Access Management - Maps users to roles and roles to other roles to manage complex permissions through inheritance and group-based access.
• Access Control Frameworks - Open-source access control library for Go applications.
• Authorization Result Caches - Stores authorization results in memory to speed up future access checks and minimize processing time.
• Persistent Storage Management - Connects to external databases, cloud services, or file systems to load and save authorization models and policy rules.
• Administrative Privilege Management - Grants unrestricted access to specific subjects across all models to ensure administrative oversight of the entire system.
• Conflict Resolution Policies - Resolves competing authorization rules using priority ordering or override logic to ensure consistent enforcement.
• Programmatic Administration Interfaces - Exposes programmatic interfaces for external systems to create, update, and delete authorization models and rules.
• Custom Pattern Matchers - Registers custom logic to evaluate complex relationships between subjects, objects, or domains, allowing a single policy rule to cover multiple resource identifiers.
• Authorization Services - Exposes access control logic as a standalone network service to decouple policy enforcement from application code.
• Function Injection Tools - Extends authorization logic by injecting custom functions for domain-specific matching and validation.
• Authorization Interceptors - Intercepts GraphQL requests before they reach resolvers to validate permissions against defined authorization policies.
• Business Constraint Enforcement - Validates role-based invariants and separation of duties during policy updates to ensure security rules remain consistent with organizational requirements.
• Orchestration Admission Controllers - Integrates with container orchestration platforms to intercept and validate resource requests against defined authorization rules.
• Runtime Permission Policies - Updates and retrieves authorization rules dynamically at runtime without requiring application restarts.
• Authorization Services - Provides a remote interface to evaluate access control policies without embedding the library directly.
• Model Persistence - Decouples authorization logic from application code by persisting model definitions in external storage.
• Policy Propagation Systems - Propagates policy changes across multiple service instances in a distributed deployment to maintain consistent authorization state.
• Proxy Authorization Integrations - Connects reverse proxies and service meshes to a centralized policy engine.
• Context-Aware Policy Engines - Supports dynamic access decisions by passing runtime environment data into the evaluation engine.
• Data Access Filters - Filters access to specific records or fields based on user attributes and defined authorization policies.
• Organization-Based Access Management - Evaluates access requests by mapping subjects, actions, and objects to roles and views within specific organizational contexts.
• Custom Matching Logic - Defines specialized role or resource matching functions to handle complex authorization requirements.
• File Pattern Matching - Registers custom functions to enable wildcard or pattern-based evaluation for user and domain names during policy enforcement.
• Access Control Policies - Applies built-in operators and custom logic to match request attributes against policy rules for flexible resource protection.
• Interface Element Visibility - Hides or displays UI elements like menus and buttons based on a user's permissions to prevent unauthorized navigation or interaction.
• Dynamic Policy Refreshers - Refreshes authorization rules in memory automatically without requiring manual restarts or redeployments.
• Policy Management Interfaces - Provides a web-based interface to draft, test, and validate access control models and policy rules without requiring a local development environment.
• Custom Matcher Functions - Extends the evaluation engine by allowing developers to register domain-specific logic for complex attribute matching.
• Implicit Permission Resolvers - Calculates effective access rights by resolving all direct and inherited permissions for a subject.
• Network Traffic Interceptors - Intercepts network traffic at the infrastructure level to validate access requests against defined security policies.
• Mandatory Access Control - Restricts user actions based on security labels and system-wide policies to ensure data confidentiality and integrity.
• Path-Based Access Rules - Validates access based on IP addresses, CIDR ranges, or RESTful URL patterns.
• Custom Matching Functions - Registers custom functions to be used within authorization matchers for evaluating complex access conditions.
• Dynamic Policy Evaluators - Executes complex logic expressions embedded directly within policy definitions at runtime.
• Policy Resolution Strategies - Aggregates multiple matching rules using built-in logic like allow-override or deny-override to resolve conflicting permissions.
• Conditional Role Access - Validates role access by executing custom logic to ensure subjects only inherit roles when specific criteria are met.
• Conditional Role Assignment - Restricts user-to-role assignments by validating them against custom runtime criteria.
• Domain-Scoped Assignment Validators - Validates user-to-role assignments within specific domains against custom logic to ensure active membership conditions are met.
• Conditional Domain Role Restrictions - Applies conditional logic to role assignments within multi-tenant environments to enforce domain-specific access.
• Access Control - Validates access permissions and system conditions throughout an entire session rather than only at the initial point of entry.
• Access Rule Management - Provides utilities for managing policy rules and role inheritance mappings to maintain access control state.
• Enforcement Performance Monitors - Tracks authorization decision latency and memory usage across project commits to ensure consistent performance.
• Atomic Transactions - Groups multiple policy changes into a single atomic operation to ensure data consistency across storage updates.
• Administrative Overrides - Permits specific subjects to bypass all defined access control policies.
• Authorization Decision Explainers - Returns the specific policy rule that granted or denied an access request to provide transparency.
• Throughput Scaling - Provides mechanisms to distribute authorization checks across multiple threads or server nodes for high-traffic environments.
• Batch Authorization Evaluators - Processes a collection of authorization checks in a single operation to efficiently validate large sets of data.
• Integrity Enforcement Policies - Restricts read and write operations based on assigned integrity levels to prevent data corruption.
• Role Hierarchy Priority Rules - Determines rule precedence based on the depth of subjects within a role tree.
• Row Level Security - Restricts access based on security levels by preventing subjects from reading higher-level data or writing to lower-level data.
• Enforcement Bypasses - Toggles the authorization engine to permit all requests regardless of defined policies, facilitating system maintenance or testing scenarios.
• User Role Management - Retrieves and audits role assignments to verify user permissions within the system.
• Filtered Policy Appenders - Adds a specific subset of access rules to the existing in-memory policy set without replacing previously loaded data.
• Lattice-Based Access Models - Evaluates subject and object security levels against confidentiality and integrity policies within a multi-dimensional framework.
• Policy Set Optimizers - Provides mechanisms to optimize large-scale authorization policy sets for improved performance and memory efficiency.
• Sequential Policy Evaluators - Evaluates access rules based on their sequence in the policy list to resolve conflicting permissions.
• Weighted Policy Evaluators - Assigns numeric weights to access rules to control which policies override others during evaluation.
• Authorization Schemas - Maps custom field names and positions for subjects, objects, and domains to align the authorization engine with specific data structures.
• Asynchronous Authorization Execution - Performs authorization tasks without blocking the main execution thread to maintain application responsiveness.
• Authorization Event Loggers - Records internal operations including model loading, policy changes, and enforcement decisions to provide visibility into access control activity.
• API Integration Services - Provides middleware to bridge authorization logic with web frameworks, API gateways, and cloud-native architectures.
• Resource Pattern Matchers - Matches resource paths and IP addresses against defined patterns using wildcards, regex, or CIDR blocks.

Star history