-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
包含acl、rbac、abac和使用mysql存储策略等再往后需要再做一些测试学习一下配置文件也就是模型和策略的写法，然后实现一个demo
- Loading branch information
Showing
31 changed files
with
697 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "github.com/casbin/casbin/v2" | ||
| "log" | ||
| ) | ||
|
|
||
| //ACL（access-control-list，访问控制列表）。ACL显示定义了每个主体对每个资源的权 | ||
| //限情况， 未定义的就没有权限。我们还可以加上超级管理员，超级管理员可以进行任何操作。假设超级管理员为root， | ||
| //我们只需要修改匹配器： | ||
|
|
||
| func check(e *casbin.Enforcer, sub, obj, act string) { | ||
| ok, _ := e.Enforce(sub, obj, act) | ||
| if ok { | ||
| fmt.Printf("%s CAN %s %s \n", sub, act, obj) | ||
| } else { | ||
| fmt.Printf("%s CANNOT %s %s \n", sub, act, obj) | ||
| } | ||
| } | ||
|
|
||
| func main() { | ||
| e, err := casbin.NewEnforcer("./model.conf", "./policy.csv") | ||
| if err != nil { | ||
| log.Fatalf("NewEnforecer failed:%v \n", err) | ||
| } | ||
| //checker1(e) | ||
| checker2(e) | ||
|
|
||
| } | ||
|
|
||
| // 测试多个人 | ||
| func checker1(e *casbin.Enforcer) { | ||
| check(e, "dajun", "data1", "read") | ||
| check(e, "lizi", "data2", "write") | ||
| check(e, "dajun", "data1", "write") | ||
| check(e, "dajun", "data2", "read") | ||
| } | ||
|
|
||
| // 测试root | ||
| func checker2(e *casbin.Enforcer) { | ||
| check(e, "root", "data1", "read") | ||
| check(e, "root", "data2", "write") | ||
| check(e, "root", "data1", "execute") | ||
| check(e, "root", "data2", "rwx") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| [request_definition] | ||
| r = sub, obj, act | ||
|
|
||
| [policy_definition] | ||
| p = sub, obj, act | ||
|
|
||
| [matchers] | ||
| m = r.sub == p.sub && r.obj == p.obj && r.act == p.act ||r.sub=="root" | ||
|
|
||
| [policy_effect] | ||
| e = some(where (p.eft == allow)) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| p, dajun, data1, read | ||
| p, lizi, data2, write |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "github.com/casbin/casbin/v2" | ||
| "log" | ||
| ) | ||
|
|
||
| func check(e *casbin.Enforcer, sub, obj, act string) { | ||
| ok, _ := e.Enforce(sub, obj, act) | ||
| if ok { | ||
| fmt.Printf("%s CAN %s %s\n", sub, act, obj) | ||
| } else { | ||
| fmt.Printf("%s CANNOT %s %s\n", sub, act, obj) | ||
| } | ||
| } | ||
|
|
||
| func main() { | ||
| e, err := casbin.NewEnforcer("./model.conf", "./policy.csv") | ||
| if err != nil { | ||
| log.Fatalf("NewEnforecer failed:%v\n", err) | ||
| } | ||
| checker1(e) | ||
| } | ||
| func checker1(e *casbin.Enforcer) { | ||
| check(e, "dajun", "data", "read") | ||
| check(e, "dajun", "data", "write") | ||
| check(e, "lizi", "data", "read") | ||
| check(e, "lizi", "data", "write") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| [role_definition] | ||
| g = _,_ | ||
|
|
||
|
|
||
| [matchers] | ||
| m= g ( r.sub,p.sub) && r.obj == p.obj &&r.act ==p.act | ||
|
|
||
|
|
||
| [request_definition] | ||
| r = sub, obj, act | ||
|
|
||
| [policy_definition] | ||
| p = sub, obj, act | ||
|
|
||
|
|
||
| [policy_effect] | ||
| e = some(where (p.eft == allow)) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| p, admin, data, read | ||
| p, admin, data, write | ||
| p, developer, data, read | ||
| g, dajun, admin | ||
| g, lizi, developer | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "github.com/casbin/casbin/v2" | ||
| "log" | ||
| ) | ||
|
|
||
| func check(e *casbin.Enforcer, sub, obj, act string) { | ||
| ok, _ := e.Enforce(sub, obj, act) | ||
| if ok { | ||
| fmt.Printf("%s CAN %s %s\n", sub, act, obj) | ||
| } else { | ||
| fmt.Printf("%s CANNOT %s %s\n", sub, act, obj) | ||
| } | ||
| } | ||
|
|
||
| func main() { | ||
| e, err := casbin.NewEnforcer("./model.conf", "./policy.csv") | ||
| if err != nil { | ||
| log.Fatalf("NewEnforecer failed:%v\n", err) | ||
| } | ||
| checker1(e) | ||
| } | ||
| func checker1(e *casbin.Enforcer) { | ||
| check(e, "dajun", "prod.data", "read") | ||
| check(e, "dajun", "prod.data", "write") | ||
| check(e, "lizi", "dev.data", "read") | ||
| check(e, "lizi", "dev.data", "write") | ||
| check(e, "lizi", "prod.data", "write") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [role_definition] | ||
| g = _,_ | ||
| g2=_,_ | ||
|
|
||
| [matchers] | ||
| m = g(r.sub, p.sub) && g2(r.obj, p.obj) && r.act == p.act | ||
| #m= g ( r.sub,p.sub) && r.obj == p.obj &&r.act ==p.act | ||
|
|
||
|
|
||
| [request_definition] | ||
| r = sub, obj, act | ||
|
|
||
| [policy_definition] | ||
| p = sub, obj, act | ||
|
|
||
|
|
||
| [policy_effect] | ||
| e = some(where (p.eft == allow)) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| p, admin, prod, read | ||
| p, admin, prod, write | ||
| p, admin, dev, read | ||
| p, admin, dev, write | ||
| p, developer, dev, read | ||
| p, developer, dev, write | ||
| p, developer, prod, read | ||
| g, dajun, admin | ||
| g, lizi, developer | ||
| g2, prod.data, prod | ||
| g2, dev.data, dev |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| 多个RBAC | ||
| casbin支持同时存在多个RBAC系统，即用户和资源都有角色： | ||
|
|
||
| [role_definition] | ||
| g=_,_ | ||
| g2=_,_ | ||
|
|
||
| [matchers] | ||
| m = g(r.sub, p.sub) && g2(r.obj, p.obj) && r.act == p.act | ||
| 上面的模型文件定义了两个RBAC系统g和g2，我们在匹配器中使用g(r.sub, p.sub)判断请求主体属于特定组，g2(r.obj, p.obj)判断请求资源属于特定组，且操作一致即可放行。 | ||
|
|
||
| 策略文件: | ||
|
|
||
| p, admin, prod, read | ||
| p, admin, prod, write | ||
| p, admin, dev, read | ||
| p, admin, dev, write | ||
| p, developer, dev, read | ||
| p, developer, dev, write | ||
| p, developer, prod, read | ||
| g, dajun, admin | ||
| g, lizi, developer | ||
| g2, prod.data, prod | ||
| g2, dev.data, dev | ||
| 先看角色关系，即最后 4 行，dajun属于admin角色，lizi属于developer角色，prod.data属于生产资源prod角色，dev.data属于开发资源dev角色。admin角色拥有对prod和dev类资源的读写权限，developer只能拥有对dev的读写权限和prod的读权限。 | ||
|
|
||
| check(e, "dajun", "prod.data", "read") | ||
| check(e, "dajun", "prod.data", "write") | ||
| check(e, "lizi", "dev.data", "read") | ||
| check(e, "lizi", "dev.data", "write") | ||
| check(e, "lizi", "prod.data", "write") | ||
| 第一个函数中e.Enforce()方法在实际执行的时候先获取dajun所属角色admin，再获取prod.data所属角色prod，根据文件中第一行p, admin, prod, read允许请求。最后一个函数中lizi属于角色developer，而prod.data属于角色prod，所有策略都不允许，故该请求被拒绝： | ||
|
|
||
| dajun CAN read prod.data | ||
| dajun CAN write prod.data | ||
| lizi CAN read dev.data | ||
| lizi CAN write dev.data | ||
| lizi CANNOT write prod.data |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "github.com/casbin/casbin/v2" | ||
| "log" | ||
| ) | ||
|
|
||
| func check(e *casbin.Enforcer, sub, obj, act string) { | ||
| ok, _ := e.Enforce(sub, obj, act) | ||
| if ok { | ||
| fmt.Printf("%s CAN %s %s\n", sub, act, obj) | ||
| } else { | ||
| fmt.Printf("%s CANNOT %s %s\n", sub, act, obj) | ||
| } | ||
| } | ||
|
|
||
| func main() { | ||
| e, err := casbin.NewEnforcer("./model.conf", "./policy.csv") | ||
| if err != nil { | ||
| log.Fatalf("NewEnforecer failed:%v\n", err) | ||
| } | ||
| checker1(e) | ||
| } | ||
| func checker1(e *casbin.Enforcer) { | ||
| check(e, "dajun", "data", "read") | ||
| check(e, "dajun", "data", "write") | ||
| check(e, "lizi", "data", "read") | ||
| check(e, "lizi", "data", "write") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [role_definition] | ||
| g = _,_ | ||
| g2=_,_ | ||
|
|
||
| [matchers] | ||
| m = g(r.sub, p.sub) && g2(r.obj, p.obj) && r.act == p.act | ||
| #m= g ( r.sub,p.sub) && r.obj == p.obj &&r.act ==p.act | ||
|
|
||
|
|
||
| [request_definition] | ||
| r = sub, obj, act | ||
|
|
||
| [policy_definition] | ||
| p = sub, obj, act | ||
|
|
||
|
|
||
| [policy_effect] | ||
| e = some(where (p.eft == allow)) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| p, senior, data, write | ||
| p, developer, data, read | ||
| g, dajun, senior | ||
| g, senior, developer | ||
| g, lizi, developer |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| 多层角色 | ||
| casbin还能为角色定义所属角色，从而实现多层角色关系，这种权限关系是可以传递的。例如dajun属于高级开发者senior，seinor属于开发者，那么dajun也属于开发者，拥有开发者的所有权限。我们可以定义开发者共有的权限，然后额外为senior定义一些特殊的权限。 | ||
|
|
||
| 模型文件不用修改，策略文件改动如下： | ||
|
|
||
| p, senior, data, write | ||
| p, developer, data, read | ||
| g, dajun, senior | ||
| g, senior, developer | ||
| g, lizi, developer | ||
| 上面policy.csv文件定义了高级开发者senior对数据data有write权限，普通开发者developer对数据只有read权限。同时senior也是developer，所以senior也继承其read权限。dajun属于senior，所以dajun对data有read和write权限，而lizi只属于developer，对数据data只有read权限。 | ||
|
|
||
| check(e, "dajun", "data", "read") | ||
| check(e, "dajun", "data", "write") | ||
| check(e, "lizi", "data", "read") | ||
| check(e, "lizi", "data", "write") |
Empty file.
Oops, something went wrong.