OrBAC

什么是 OrBAC？

OrBAC (Organisation-Based Access Control) 通过 抽象层 和 组织维度 扩展了 RBAC。策略引用 角色、活动 和 视图；具体的用户、操作和对象按组织映射到这些抽象概念上。当实体发生变化时，这有助于保持策略的稳定性。

三个映射（均按组织范围限定）：

• Empower — 用户 → 角色
• Use — 操作 → 活动
• Consider — 对象 → 视图

当请求中的 (subject, action, object) 映射到该组织中拥有权限的 (role, activity, view) 时，授予权限。

模型

[request_definition]
r = sub, org, obj, act

[policy_definition]
p = role, activity, view, org

[role_definition]
g = _, _, _
g2 = _, _, _
g3 = _, _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.role, r.org) && g2(r.act, p.activity, r.org) && g3(r.obj, p.view, r.org) && r.org == p.org

• g — 用户在组织中拥有角色 (Empower)
• g2 — 操作在组织中属于某活动 (Use)
• g3 — 对象在组织中属于某视图 (Consider)
• r.org == p.org — 同一组织

策略示例

权限规则指定在每个组织中，哪些角色可以在哪些视图上执行哪些活动：

# Permission: role, activity, view, organization
p, manager, modify, document, org1
p, manager, consult, document, org1
p, employee, consult, document, org1
p, manager, modify, report, org2
p, manager, consult, report, org2
p, employee, consult, report, org2

Empower 规则在组织内将角色分配给主体：

# Empower: subject, role, organization
g, alice, manager, org1
g, bob, employee, org1
g, charlie, manager, org2
g, david, employee, org2

Use 规则将具体操作映射到抽象活动：

# Use: action, activity, organization
g2, write, modify, org1
g2, read, consult, org1
g2, write, modify, org2
g2, read, consult, org2

Consider 规则将具体对象映射到抽象视图：

# Consider: object, view, organization
g3, data1, document, org1
g3, data2, document, org1
g3, report1, report, org2
g3, report2, report, org2

代码示例

import "github.com/casbin/casbin/v3"

e, _ := casbin.NewEnforcer("examples/orbac_model.conf", "examples/orbac_policy.csv")

// alice is a manager in org1, can read and write documents
ok, _ := e.Enforce("alice", "org1", "data1", "read")   // true
ok, _ = e.Enforce("alice", "org1", "data1", "write")   // true

// bob is an employee in org1, can only read documents
ok, _ = e.Enforce("bob", "org1", "data1", "read")      // true
ok, _ = e.Enforce("bob", "org1", "data1", "write")     // false

// charlie is a manager in org2, can read and write reports
ok, _ = e.Enforce("charlie", "org2", "report1", "read")   // true
ok, _ = e.Enforce("charlie", "org2", "report1", "write")  // true

// Cross-organization access is denied
ok, _ = e.Enforce("alice", "org2", "report1", "read")  // false
ok, _ = e.Enforce("charlie", "org1", "data1", "read")  // false

优势

• 抽象化 — 策略使用角色、活动和视图；您可以更改具体映射而无需重写策略。
• 按组织隔离 — 每个组织拥有自己的映射和权限；一个模型即可覆盖所有组织。
• 可扩展性 — 在多组织设置中实现更少且更清晰的规则。