casbin实现基于角色的HTTP权限控制

casbin介绍

casbin是由北大的一位博士生主导开发的一个基于Go语言的权限控制库。支持 ACL，RBAC，ABAC 等常用的访问控制模型。

casbin是Golang项目的强大而高效的开源访问控制库。 它支持基于各种访问控制模型实施授权。

casbin的核心是一套基于PERM metamodel(Policy, Effect, Request, Matchers)的DSL。Casbin从用这种DSL定义的配置文件中读取访问控制模型，作为后续权限验证的基础

Casbin做了什么

  • 支持自定义请求的格式，默认的请求格式为{subject, object, action}。
  • 具有访问控制模型model和策略policy两个核心概念。
  • 支持RBAC中的多层角色继承，不止主体可以有角色，资源也可以具有角色。
  • 支持超级用户，如root或Administrator，超级用户可以不受授权策略的约束访问任意资源。
  • 支持多种内置的操作符，如keyMatch，方便对路径式的资源进行管理，如/foo/bar可以映射到/foo*

Casbin不做的事情

  • 身份认证authentication(即验证用户的用户名、密码)，casbin只负责访问控制。应该有其他专门的组件负责身份认证，然后由casbin进行访问控制，二者是相互配合的关系。
  • 管理用户列表或角色列表。Casbin认为由项目自身来管理用户、角色列表更为合适，用户通常有他们的密码，但是Casbin的设计思想并不是把它作为一个存储密码的容器。而是存储RBAC方案中用户和角色之间的映射关系。

配置示例

模型与策略定制

  1. //sub   "alice"// 想要访问资源的用户.
  2. //obj  "data1" // 要访问的资源.
  3. //act  "read"  // 用户对资源执行的操作.
  5. # Request definition
  6. [request_definition]
  7. r = sub, obj, act
  9. # Policy definition
  10. [policy_definition]
  11. p = sub, obj, act
  13. # Policy effect
  14. [policy_effect]
  15. e = some(where (p.eft == allow))
  17. # Matchers
  18. [matchers]
  19. m = r.sub == p.sub && r.obj == p.obj && r.act == p.act

可以看到这个配置文件主要定义了Request和Policy的组成结构.Policy effect和Matchers则灵活的多，可以包含一些自定义的表达式比如我们要加入一个名叫root的超级管理员，就可以这样写:

  1. [matchers]
  2. m = r.sub == p.sub && r.obj == p.obj && r.act == p.act || r.sub == "root"

又比如我们可以用正则匹配来判断权限是否匹配:

  1. [matchers]
  2. m = r.sub == p.sub && keyMatch(r.obj, p.obj) && regexMatch(r.act, p.act)

具体规则设置

  1. p, alice, data1, read
  2. p, bob, data2, write

意思就是 alice 可以读 data1，bob 可以写 data2

示例

模型与策略定制 test.conf

  1. [request_definition]
  2. r = sub, dom, obj, act
  4. [policy_definition]
  5. p = sub, dom, obj, act
  7. [role_definition]
  8. g = _, _, _
  10. [policy_effect]
  11. e = some(where (p.eft == allow))
  13. [matchers]
  14. m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && r.obj == p.obj && r.act == p.act

具体规则设置 test.csv

  1. p, admin, domain1, data1, read
  2. p, admin, domain1, data1, write
  3. p, admin, domain2, data2, read
  4. p, admin, domain2, data2, write
  5. g, alice, admin, domain1
  6. g, bob, admin, domain2

如上所示，alice 和 bob 分别是 domian1 和 domain2 的管理员

iris示例代码

1.中间件格式 错误返回forbidden

目录结构

主目录middleware

  1.     —— casbinmodel.conf
  2.     —— casbinpolicy.csv
  3.     —— main.go
  4.     —— main_test.go

代码示例

casbinmodel.conf

  1. [request_definition]
  2. r = sub, obj, act
  4. [policy_definition]
  5. p = sub, obj, act
  7. [role_definition]
  8. g = _, _
  10. [policy_effect]
  11. e = some(where (p.eft == allow))
  13. [matchers]
  14. m = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && (r.act == p.act || p.act == "*")

casbinpolicy.csv

  1. p, alice, /dataset1/*, GET
  2. p, alice, /dataset1/resource1, POST
  3. p, bob, /dataset2/resource1, *
  4. p, bob, /dataset2/resource2, GET
  5. p, bob, /dataset2/folder1/*, POST

main.go

  1. package main
  3. import (
  4.     "github.com/kataras/iris"
  5.     "github.com/casbin/casbin"
  6.     cm "github.com/iris-contrib/middleware/casbin"
  7. )
  9. // $ go get github.com/casbin/casbin
  10. // $ go run main.go
  11. // Enforcer映射模型和casbin服务的策略，我们也在main_test上使用此变量。
  12. var Enforcer = casbin.NewEnforcer("casbinmodel.conf", "casbinpolicy.csv")
  14. func newApp() *iris.Application {
  15.     casbinMiddleware := cm.New(Enforcer)
  16.     app := iris.New()
  17.     app.Use(casbinMiddleware.ServeHTTP)
  18.     app.Get("/", hi)
  19.     app.Get("/dataset1/{p:path}", hi) // p, alice, /dataset1/*, GET
  20.     app.Post("/dataset1/resource1", hi)
  21.     app.Get("/dataset2/resource2", hi)
  22.     app.Post("/dataset2/folder1/{p:path}", hi)
  23.     app.Any("/dataset2/resource1", hi)
  24.     return app
  25. }
  27. func main() {
  28.     app := newApp()
  29.     app.Run(iris.Addr(":8080"))
  30. }
  32. func hi(ctx iris.Context) {
  33.     ctx.Writef("Hello %s", cm.Username(ctx.Request()))
  34. }

main_test.go

  1. package main
  3. import (
  4.     "testing"
  5.     "github.com/iris-contrib/httpexpect"
  6.     "github.com/kataras/iris/httptest"
  7. )
  9. func TestCasbinMiddleware(t *testing.T) {
  10.     app := newApp()
  11.     e := httptest.New(t, app, httptest.Debug(false))
  13.     type ttcasbin struct {
  14.         username string
  15.         path     string
  16.         method   string
  17.         status   int
  18.     }
  20.     tt := []ttcasbin{
  21.         {"alice", "/dataset1/resource1", "GET", 200},
  22.         {"alice", "/dataset1/resource1", "POST", 200},
  23.         {"alice", "/dataset1/resource2", "GET", 200},
  24.         {"alice", "/dataset1/resource2", "POST", 404},
  26.         {"bob", "/dataset2/resource1", "GET", 200},
  27.         {"bob", "/dataset2/resource1", "POST", 200},
  28.         {"bob", "/dataset2/resource1", "DELETE", 200},
  29.         {"bob", "/dataset2/resource2", "GET", 200},
  30.         {"bob", "/dataset2/resource2", "POST", 404},
  31.         {"bob", "/dataset2/resource2", "DELETE", 404},
  33.         {"bob", "/dataset2/folder1/item1", "GET", 404},
  34.         {"bob", "/dataset2/folder1/item1", "POST", 200},
  35.         {"bob", "/dataset2/folder1/item1", "DELETE", 404},
  36.         {"bob", "/dataset2/folder1/item2", "GET", 404},
  37.         {"bob", "/dataset2/folder1/item2", "POST", 200},
  38.         {"bob", "/dataset2/folder1/item2", "DELETE", 404},
  39.     }
  41.     for _, tt := range tt {
  42.         check(e, tt.method, tt.path, tt.username, tt.status)
  43.     }
  44. }
  46. func check(e *httpexpect.Expect, method, path, username string, status int) {
  47.     e.Request(method, path).WithBasicAuth(username, "password").Expect().Status(status)
  48. }

2.路由修饰模式 错误返回403

目录结构

主目录wrapper

  1.     —— casbinmodel.conf
  2.     —— casbinpolicy.csv
  3.     —— main.go
  4.     —— main_test.go

代码示例

casbinmodel.conf

  1. [request_definition]
  2. r = sub, obj, act
  4. [policy_definition]
  5. p = sub, obj, act
  7. [role_definition]
  8. g = _, _
  10. [policy_effect]
  11. e = some(where (p.eft == allow))
  13. [matchers]
  14. m = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && (r.act == p.act || p.act == "*")

casbinpolicy.csv

  1. p, alice, /dataset1/*, GET
  2. p, alice, /dataset1/resource1, POST
  3. p, bob, /dataset2/resource1, *
  4. p, bob, /dataset2/resource2, GET
  5. p, bob, /dataset2/folder1/*, POST
  6. p, cathrin, /dataset2/resource2, GET
  7. p, dataset1_admin, /dataset1/*, *
  8. g, cathrin, dataset1_admin

main.go

  1. package main
  3. import (
  4.     "github.com/kataras/iris"
  6.     "github.com/casbin/casbin"
  7.     cm "github.com/iris-contrib/middleware/casbin"
  8. )
  10. // $ go get github.com/casbin/casbin
  11. // $ go run main.go
  12. // Enforcer映射模型和casbin服务的策略，我们也在main_test上使用此变量。
  13. var Enforcer = casbin.NewEnforcer("casbinmodel.conf", "casbinpolicy.csv")
  15. func newApp() *iris.Application {
  16.     casbinMiddleware := cm.New(Enforcer)
  17.     app := iris.New()
  18.     app.WrapRouter(casbinMiddleware.Wrapper())
  19.     app.Get("/", hi)
  20.     app.Any("/dataset1/{p:path}", hi) // p, dataset1_admin, /dataset1/*, * && p, alice, /dataset1/*, GET
  21.     app.Post("/dataset1/resource1", hi)
  22.     app.Get("/dataset2/resource2", hi)
  23.     app.Post("/dataset2/folder1/{p:path}", hi)
  24.     app.Any("/dataset2/resource1", hi)
  26.     return app
  27. }
  29. func main() {
  30.     app := newApp()
  31.     app.Run(iris.Addr(":8080"))
  32. }
  34. func hi(ctx iris.Context) {
  35.     ctx.Writef("Hello %s", cm.Username(ctx.Request()))
  36. }

main_test.go

  1. package main
  3. import (
  4.     "testing"
  6.     "github.com/iris-contrib/httpexpect"
  7.     "github.com/kataras/iris/httptest"
  8. )
  10. func TestCasbinWrapper(t *testing.T) {
  11.     app := newApp()
  12.     e := httptest.New(t, app)
  14.     type ttcasbin struct {
  15.         username string
  16.         path     string
  17.         method   string
  18.         status   int
  19.     }
  21.     tt := []ttcasbin{
  22.         {"alice", "/dataset1/resource1", "GET", 200},
  23.         {"alice", "/dataset1/resource1", "POST", 200},
  24.         {"alice", "/dataset1/resource2", "GET", 200},
  25.         {"alice", "/dataset1/resource2", "POST", 403},
  27.         {"bob", "/dataset2/resource1", "GET", 200},
  28.         {"bob", "/dataset2/resource1", "POST", 200},
  29.         {"bob", "/dataset2/resource1", "DELETE", 200},
  30.         {"bob", "/dataset2/resource2", "GET", 200},
  31.         {"bob", "/dataset2/resource2", "POST", 403},
  32.         {"bob", "/dataset2/resource2", "DELETE", 403},
  34.         {"bob", "/dataset2/folder1/item1", "GET", 403},
  35.         {"bob", "/dataset2/folder1/item1", "POST", 200},
  36.         {"bob", "/dataset2/folder1/item1", "DELETE", 403},
  37.         {"bob", "/dataset2/folder1/item2", "GET", 403},
  38.         {"bob", "/dataset2/folder1/item2", "POST", 200},
  39.         {"bob", "/dataset2/folder1/item2", "DELETE", 403},
  40.     }
  42.     for _, tt := range tt {
  43.         check(e, tt.method, tt.path, tt.username, tt.status)
  44.     }
  46.     ttAdmin := []ttcasbin{
  47.         {"cathrin", "/dataset1/item", "GET", 200},
  48.         {"cathrin", "/dataset1/item", "POST", 200},
  49.         {"cathrin", "/dataset1/item", "DELETE", 200},
  50.         {"cathrin", "/dataset2/item", "GET", 403},
  51.         {"cathrin", "/dataset2/item", "POST", 403},
  52.         {"cathrin", "/dataset2/item", "DELETE", 403},
  53.     }
  55.     for _, tt := range ttAdmin {
  56.         check(e, tt.method, tt.path, tt.username, tt.status)
  57.     }
  59.     Enforcer.DeleteRolesForUser("cathrin")
  61.     ttAdminDeleted := []ttcasbin{
  62.         {"cathrin", "/dataset1/item", "GET", 403},
  63.         {"cathrin", "/dataset1/item", "POST", 403},
  64.         {"cathrin", "/dataset1/item", "DELETE", 403},
  65.         {"cathrin", "/dataset2/item", "GET", 403},
  66.         {"cathrin", "/dataset2/item", "POST", 403},
  67.         {"cathrin", "/dataset2/item", "DELETE", 403},
  68.     }
  70.     for _, tt := range ttAdminDeleted {
  71.         check(e, tt.method, tt.path, tt.username, tt.status)
  72.     }
  74. }
  76. func check(e *httpexpect.Expect, method, path, username string, status int) {
  77.     e.Request(method, path).WithBasicAuth(username, "password").Expect().Status(status)
  78. }

提示

  • 以上的go iris都是使用Basic Auth,用postman测试请选择Authorization选项
  • .conf文件是配置规则模型，.csv是具体规则的体现，当然也可不使用这些东西，用户数据或者其他代替
  • 解释一下我对这些的理解
  1. //policy策略
  2. p, alice, /dataset1/*, GET         //alice 用户有对 method为GET路径满足 /dataset1/*的访问权限 下面同理
  3. p, alice, /dataset1/resource1, POST
  4. p, bob, /dataset2/resource1, *
  5. p, bob, /dataset2/resource2, GET
  6. p, bob, /dataset2/folder1/*, POST
  7. p, cathrin, /dataset2/resource2, GET
  8. p, dataset1_admin, /dataset1/*, *
  9. g, cathrin, dataset1_admin  //cathrin用户属于dataset1_admin组，也就是dataset1_admin能访问的cathrin都能访问，反之不然
  1. //配置
  2. [request_definition]        //请求定义
  3. r = sub, obj, act
  5. [policy_definition]         //策略定义，也就是*.cvs文件 p 定义的格式
  6. p = sub, obj, act
  8. [role_definition]           //组定义，也就是*.cvs文件 g 定义的格式
  9. g = _, _
  11. [policy_effect]              
  12. e = some(where (p.eft == allow))
  14. [matchers]                 //满足条件
  15. m = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && (r.act == p.act || p.act == "*")
  16. //请求用户与满足*.cvs p(策略)且满足g(组规则)且请求资源满足p(策略)规定资源