Skip to main content

Supported Models

  1. ACL (Access Control List)
  2. ACL with superuser
  3. ACL without users: This is especially useful for systems that don't have authentication or user logins.
  4. ACL without resources: In some scenarios, the target is a type of resource instead of an individual resource. Permissions like "write-article" and "read-log" can be used. This doesn't control access to a specific article or log.
  5. RBAC (Role-Based Access Control)
  6. RBAC with resource roles: Both users and resources can have roles (or groups) at the same time.
  7. RBAC with domains/tenants: Users can have different sets of roles for different domains/tenants.
  8. ABAC (Attribute-Based Access Control): Syntax sugar like "resource.Owner" can be used to get the attribute for a resource.
  9. PBAC (Policy-Based Access Control): A flexible access control model that makes authorization decisions based on policies defined as rules, supporting dynamic and contextual authorization.
  10. BLP (Bell-LaPadula): A formal state transition model of computer security policy that describes a set of access control rules which use security labels on objects and clearances for subjects.
  11. Biba (Biba Integrity Model): A computer security model that restricts information flow in a system to prevent unauthorized disclosure of classified information.
  12. LBAC (Lattice-Based Access Control): A formal access control model that combines confidentiality and integrity controls in a unified framework, implementing a lattice structure for granular access control decisions.
  13. UCON (Usage Control): A next-generation access control model that emphasizes continuous authorization, attribute mutability, and a unified framework of authorizations, obligations, and conditions.
  14. RESTful: Supports paths like "/res/*", "/res/:id", and HTTP methods like "GET", "POST", "PUT", "DELETE".
  15. IP Match: Supports IP address matching for network-based access control.
  16. Deny-override: Both allow and deny authorizations are supported, where deny overrides allow.
  17. Priority: The policy rules can be prioritized, similar to firewall rules.

Examples​

ModelModel filePolicy file
ACLbasic_model.confbasic_policy.csv
ACL with superuserbasic_with_root_model.confbasic_policy.csv
ACL without usersbasic_without_users_model.confbasic_without_users_policy.csv
ACL without resourcesbasic_without_resources_model.confbasic_without_resources_policy.csv
RBACrbac_model.confrbac_policy.csv
RBAC with resource rolesrbac_with_resource_roles_model.confrbac_with_resource_roles_policy.csv
RBAC with domains/tenantsrbac_with_domains_model.confrbac_with_domains_policy.csv
ReBACrebac_model.confrebac_policy.csv
ABACabac_model.confN/A
BLPblp_model.confN/A
Bibabiba_model.confN/A
LBAClbac_model.confN/A
IP Matchipmatch_model.confipmatch_policy.csv
RESTfulkeymatch_model.confkeymatch_policy.csv
Deny-overriderbac_with_not_deny_model.confrbac_with_deny_policy.csv
Allow-and-denyrbac_with_deny_model.confrbac_with_deny_policy.csv
Prioritypriority_model.confpriority_policy.csv
Explicit Prioritypriority_model_explicitpriority_policy_explicit.csv
Subject-Prioritysubject_priority_model.confsubject_priority_policyl.csv