Pure permission groups assignable for specific domains/groups/tenants

[casbin]

Pure permission groups assignable for specific domains/groups/tenants

[dwang7]

@Slind14
@hsluoyz
@nodece

Can you explain why this isn't supported?

I created this model file and it seems to work fine.

[request_definition]
r = sub, dom, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
g = _, _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub, r.dom) && r.obj == p.obj && r.act == p.act

============================================================

p, read_role, data1, read
p, read_role, data2, read
p, write_role, data1, write
p, write_role, data2, write

g, alice, read_role, pepsi
g, alice, write_role, coke

============================================

domain is assigned in the group and not in the policy.

Enforcement works with this model.

[hsluoyz]

Can you give more users/groups/domains in your example, like 2 or 3. I can't definitely tell what you are trying to do with only one user and one domain.

[Slind14]

Sure, is this better to understand?

p, group_admin, subject_blog, permission_* # groups are defined on a global scope without domain relation
p, group_manager, subject_blog, permission_write
p, group_guest, subject_blog, permission_read

g, group_manager, group_guest # manager inherits guest permissions

g, user_a, group_admin, domain_7 # groups are assigned on domain level
g, user_b, group_admin, domain_3
g, user_c, group_guest, domain_3
g, user_d, group_user, domain_1

[nodece]

@Slind14 casbin does not support this.

[nodece]

@dwang7 I apologize for my answer, you are right.

[dwang7]

@nodece

Thanks for the confirmation.

One question. Is it possible to define a domain group and reference that domain group in the role?

ie:

my_domains: (pepsi, coke, sprite)

g, alice, read_role, my_domains

how would I do this in casbin?

If not, any pointers on how and where to implement this functionality?

[nodece]

@dwang7 Awesome! You can do that, this is something I didn't expect 👍

[dwang7]

@dwang7 Awesome! You can do that, this is something I didn't expect 👍

@nodece so you're saying its not possible to do this currently?

[nodece]

@dwang7 I mean you can do that, this is a good idea.

[hsluoyz]

@dwang7 please raise a new GitHub issue for a new question.

[dwang7]

@dwang7 I mean you can do that, this is a good idea.

@nodece
@hsluoyz

adding domain_groups feature to pycasbin in a forked repo

dwang7/pycasbin@c0d537d

[hsluoyz]

@dwang7 great to see it! Can you explain how it works and even make a PR to the official repo?

[dwang7]

@hsluoyz

This is just an initial commit. Wanted to get some feedback on my implementation. Its not optimized for large data sets yet.

Basically, I've added a new ptype, d, which is domain_groups.

https://github.com/dwang7/pycasbin/blob/master/examples/rbac_with_domain_groups_model.conf
https://github.com/dwang7/pycasbin/blob/master/examples/rbac_with_domain_groups_policy.csv

When you add to the roles, g, you can specify the domain_group instead of the domain.

g, bob, read_role, beverages

d, pepsi, beverages
d, coke, beverages
d, sprite, beverages