ข้ามไปยังเนื้อหาหลัก

Supported Models

Casbin supports the following access control models and patterns. If you are not sure which one you need, start with Choosing an access control model.

  1. ACL (Access Control List)
  2. ACL ที่มี superuser
  3. ACL without users — For systems without authentication or user identity (e.g. API-only or device access).
  4. ACL without resources — When permissions apply to resource types rather than specific instances (e.g. "write-article", "read-log").
  5. RBAC (Role-Based Access Control)
  6. RBAC with resource roles — Both users and resources can have roles (or group memberships).
  7. RBAC with domains/tenants — Users can have different roles in different domains or tenants.
  8. ABAC (Attribute-Based Access Control) — Uses attributes (e.g. resource.Owner) in rules.
  9. PBAC (Policy-Based Access Control) — Authorization is driven by rule-based policies for dynamic, context-aware decisions.
  10. BLP (Bell–LaPadula) — Formal model with security labels and clearances.
  11. Biba — Integrity model that restricts information flow to prevent unauthorized changes.
  12. LBAC (Lattice-Based Access Control) — Combines confidentiality and integrity in a lattice-based framework.
  13. OrBAC (Organisation-Based Access Control) — RBAC extended with abstraction layers for multi-organization policies.
  14. UCON (Usage Control) — Covers ongoing authorization, mutable attributes, obligations, and conditions.
  15. RESTful — Path patterns (e.g. /res/*, /res/:id) and HTTP methods (GET, POST, PUT, DELETE).
  16. IP Match — Match by IP address or CIDR for network-level control.
  17. Deny-override — Both allow and deny policies; deny overrides allow.
  18. Priority — Policy rules are ordered (e.g. like firewall rules); first match wins.

ตัวอย่าง​

Modelไฟล์ Modelไฟล์ Policy
ACLbasic_model.confbasic_policy.csv
ACL ที่มี superuserbasic_with_root_model.confbasic_policy.csv
ACL ที่ไม่มีผู้ใช้งานbasic_without_users_model.confbasic_without_users_policy.csv
ACL ที่ไม่มีทรัพยากรbasic_without_resources_model.confbasic_without_resources_policy.csv
RBACrbac_model.confrbac_policy.csv
RBAC กับบทบาทของทรัพยากรrbac_with_resource_roles_model.confrbac_with_resource_roles_policy.csv
RBAC กับโดเมน/ผู้เช่าrbac_with_domains_model.confrbac_with_domains_policy.csv
ReBACrebac_model.confrebac_policy.csv
ABACabac_model.confN/A
BLPblp_model.confN/A
Bibabiba_model.confN/A
LBAClbac_model.confN/A
OrBACorbac_model.conforbac_policy.csv
IP Matchipmatch_model.confipmatch_policy.csv
RESTfulkeymatch_model.confkeymatch_policy.csv
Deny-overriderbac_with_not_deny_model.confrbac_with_deny_policy.csv
Allow-and-denyrbac_with_deny_model.confrbac_with_deny_policy.csv
Prioritypriority_model.confpriority_policy.csv
ลำดับความสำคัญที่ชัดเจนpriority_model_explicitpriority_policy_explicit.csv
ลำดับความสำคัญของผู้ใช้subject_priority_model.confsubject_priority_policyl.csv

Comments are powered by giscus and GitHub Discussions. They load from giscus.app and GitHub only after you click the button below.