id: supported-models title: Supported Models

  1. ACL (Access Control List)
  2. ACL with superuser
  3. ACL without users: especially useful for systems that don't have authentication or user log-ins.
  4. ACL without resources: some scenarios may target for a type of resources instead of an individual resource by using permissions like write-article, read-log. It doesn't control the access to a specific article or log.
  5. RBAC (Role-Based Access Control)
  6. RBAC with resource roles: both users and resources can have roles (or groups) at the same time.
  7. RBAC with domains/tenants: users can have different role sets for different domains/tenants.
  8. ABAC (Attribute-Based Access Control): syntax sugar like resource.Owner can be used to get the attribute for a resource.
  9. RESTful: supports paths like /res/*, /res/:id and HTTP methods like GET, POST, PUT, DELETE.
  10. Deny-override: both allow and deny authorizations are supported, deny overrides the allow.
  11. Priority: the policy rules can be prioritized like firewall rules.

Examples

ModelModel filePolicy file
ACLbasic_model.confbasic_policy.csv
ACL with superuserbasic_model_with_root.confbasic_policy.csv
ACL without usersbasic_model_without_users.confbasic_policy_without_users.csv
ACL without resourcesbasic_model_without_resources.confbasic_policy_without_resources.csv
RBACrbac_model.confrbac_policy.csv
RBAC with resource rolesrbac_model_with_resource_roles.confrbac_policy_with_resource_roles.csv
RBAC with domains/tenantsrbac_model_with_domains.confrbac_policy_with_domains.csv
ABACabac_model.confN/A
RESTfulkeymatch_model.confkeymatch_policy.csv
Deny-overriderbac_model_with_deny.confrbac_policy_with_deny.csv
Prioritypriority_model.confpriority_policy.csv