Get Started

インストール

Go

go get github.com/casbin/casbin/v2

Java

Mavenの場合:

<!-- https://mvnrepository.com/artifact/org.casbin/jcasbin -->
<dependency>
    <groupId>org.casbin</groupId>
    <artifactId>jcasbin</artifactId>
    <version>1.x.y</version>
</dependency>

GraalVM Native Image Support

If you're building a native application with GraalVM (e.g., using Quarkus or Spring Native), jCasbin requires special configuration due to its use of the Aviator expression engine.

By default, Aviator uses dynamic class generation via ASM, which is not supported in GraalVM native images. To resolve this, you must configure Aviator to use interpreter mode instead of compilation mode.

For Quarkus applications:

Add the following to your application.properties or pom.xml:

<properties>
    <quarkus.native.additional-build-args>
        -J-Daviator.eval.mode=INTERPRETER
    </quarkus.native.additional-build-args>
</properties>

For other GraalVM native builds:

Set the system property when building the native image:

-Daviator.eval.mode=INTERPRETER

Or configure it programmatically before initializing jCasbin:

System.setProperty("aviator.eval.mode", "INTERPRETER");

メモ

This configuration switches Aviator from its default compilation mode to interpreter mode. While this may have a slight performance impact, it enables full compatibility with GraalVM native images by avoiding runtime class generation.

Node.js

# NPM
npm install casbin --save

# Yarn
yarn add casbin

PHP

プロジェクトのcomposer.jsonでこのパッケージを要求して、パッケージをダウンロードします:

composer require casbin/casbin

Python

pip install casbin

.NET

dotnet add package Casbin.NET

C++

# Download source
git clone https://github.com/casbin/casbin-cpp.git

# Generate project files
cd casbin-cpp && mkdir build && cd build && cmake .. -DCMAKE_BUILD_TYPE=Release

# Build and install casbin
cmake --build . --config Release --target casbin install -j 10

Rust

cargo install cargo-edit
cargo add casbin

// If you use async-std as async executor
cargo add async-std

// If you use tokio as async executor, make sure you activate its `macros` feature
cargo add tokio

Delphi

Casbin4Dはパッケージ（現在はDelphi 10.3 Rio用）として提供され、IDEにインストールすることができます。 ただし、視覚的なコンポーネントはないため、パッケージに関係なくユニットを使用することができます。 プロジェクトにユニットをインポートするだけです（ユニットの数が気にならない場合）。

Lua

luarocks install casbin

エラーメッセージ「あなたのユーザーは/usr/local/lib/luarocks/rocksに書き込み権限がありません」が表示された場合、特権ユーザーとしてコマンドを実行するか、--localを使用してローカルツリーを使用することを検討してみてください。 エラーを修正するには、コマンドの後ろに--localを追加することができます。

luarocks install casbin --local

新しいCasbinエンフォーサーを作成する

Casbinは設定ファイルを使用してアクセス制御モデルを定義します。

設定ファイルは二つあります：model.confとpolicy.csvです。 model.confはアクセスモデルを保存し、policy.csvは特定のユーザー権限設定を保存します。 Casbinの使用方法は非常に直感的です。 主要な構造体を一つ作成するだけです：エンフォーサー。 この構造体を構築するとき、model.confとpolicy.csvが読み込まれます。

つまり、Casbinエンフォーサーを作成するには、ModelとAdapterを提供する必要があります。

Casbinは使用できるFileAdapterを提供しています。 詳細はAdapterを参照してください。

• モデルファイルとデフォルトのFileAdapterを使用した例:

Go

import "github.com/casbin/casbin/v2"

e, err := casbin.NewEnforcer("path/to/model.conf", "path/to/policy.csv")

Java

import org.casbin.jcasbin.main.Enforcer;

Enforcer e = new Enforcer("path/to/model.conf", "path/to/policy.csv");

Node.js

import { newEnforcer } from 'casbin';

const e = await newEnforcer('path/to/model.conf', 'path/to/policy.csv');

PHP

require_once './vendor/autoload.php';

use Casbin\Enforcer;

$e = new Enforcer("path/to/model.conf", "path/to/policy.csv");

Python

import casbin

e = casbin.Enforcer("path/to/model.conf", "path/to/policy.csv")

.NET

using NetCasbin;

var e = new Enforcer("path/to/model.conf", "path/to/policy.csv");

C++

#include <iostream>
#include <casbin/casbin.h>

int main() {
    // Create an Enforcer
    casbin::Enforcer e("path/to/model.conf", "path/to/policy.csv");

    // your code ..
}

Delphi

var
  casbin: ICasbin;
begin
  casbin := TCasbin.Create('path/to/model.conf', 'path/to/policy.csv');
  ...
end

Rust

use casbin::prelude::*;

// If you use async_td as async executor
#[cfg(feature = "runtime-async-std")]
#[async_std::main]
async fn main() -> Result<()> {
    let mut e = Enforcer::new("path/to/model.conf", "path/to/policy.csv").await?;
    Ok(())
}

// If you use tokio as async executor
#[cfg(feature = "runtime-tokio")]
#[tokio::main]
async fn main() -> Result<()> {
    let mut e = Enforcer::new("path/to/model.conf", "path/to/policy.csv").await?;
    Ok(())
}

Lua

local Enforcer = require("casbin")
local e = Enforcer:new("path/to/model.conf", "path/to/policy.csv") -- The Casbin Enforcer

• 他のアダプターとモデルテキストを使用する:

Go

import (
    "log"

    "github.com/casbin/casbin/v2"
    "github.com/casbin/casbin/v2/model"
    xormadapter "github.com/casbin/xorm-adapter/v2"
    _ "github.com/go-sql-driver/mysql"
)

// Initialize a Xorm adapter with MySQL database.
a, err := xormadapter.NewAdapter("mysql", "mysql_username:mysql_password@tcp(127.0.0.1:3306)/")
if err != nil {
    log.Fatalf("error: adapter: %s", err)
}

m, err := model.NewModelFromString(`
[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = r.sub == p.sub && r.obj == p.obj && r.act == p.act
`)
if err != nil {
    log.Fatalf("error: model: %s", err)
}

e, err := casbin.NewEnforcer(m, a)
if err != nil {
    log.Fatalf("error: enforcer: %s", err)
}

Python

import casbin
import casbin_sqlalchemy_adapter


# Use SQLAlchemy Casbin adapter with SQLLite DB
adapter = casbin_sqlalchemy_adapter.Adapter('sqlite:///test.db')

# Create a config model policy
with open("rbac_example_model.conf", "w") as f:
    f.write("""
    [request_definition]
    r = sub, obj, act

    [policy_definition]
    p = sub, obj, act

    [policy_effect]
    e = some(where (p.eft == allow))

    [matchers]
    m = r.sub == p.sub && r.obj == p.obj && r.act == p.act
    """)

# Create enforcer from adapter and config policy
e = casbin.Enforcer('rbac_example_model.conf', adapter)

権限の確認

アクセスが発生する直前に、コードに強制フックを追加します:

Go

sub := "alice" // the user that wants to access a resource.
obj := "data1" // the resource that is going to be accessed.
act := "read" // the operation that the user performs on the resource.

ok, err := e.Enforce(sub, obj, act)

if err != nil {
    // handle err
}

if ok == true {
    // permit alice to read data1
} else {
    // deny the request, show an error
}

// You could use BatchEnforce() to enforce some requests in batches.
// This method returns a bool slice, and this slice's index corresponds to the row index of the two-dimensional array.
// e.g. results[0] is the result of {"alice", "data1", "read"}
results, err := e.BatchEnforce([][]interface{}{{"alice", "data1", "read"}, {"bob", "data2", "write"}, {"jack", "data3", "read"}})

Java

String sub = "alice"; // the user that wants to access a resource.
String obj = "data1"; // the resource that is going to be accessed.
String act = "read"; // the operation that the user performs on the resource.

if (e.enforce(sub, obj, act) == true) {
    // permit alice to read data1
} else {
    // deny the request, show an error
}

GraalVM Native Image Note

If you're running jCasbin in a GraalVM native image environment, make sure you've configured Aviator to use interpreter mode as described in the installation section above. Without this configuration, you'll encounter an UnsupportedFeatureError due to runtime class generation attempts.

Node.js

const sub = 'alice'; // the user that wants to access a resource.
const obj = 'data1'; // the resource that is going to be accessed.
const act = 'read'; // the operation that the user performs on the resource.

if ((await e.enforce(sub, obj, act)) === true) {
    // permit alice to read data1
} else {
    // deny the request, show an error
}

PHP

$sub = "alice"; // the user that wants to access a resource.
$obj = "data1"; // the resource that is going to be accessed.
$act = "read"; // the operation that the user performs on the resource.

if ($e->enforce($sub, $obj, $act) === true) {
    // permit alice to read data1
} else {
    // deny the request, show an error
}

Python

sub = "alice"  # the user that wants to access a resource.
obj = "data1"  # the resource that is going to be accessed.
act = "read"  # the operation that the user performs on the resource.

if e.enforce(sub, obj, act):
    # permit alice to read data1
    pass
else:
    # deny the request, show an error
    pass

.NET

var sub = "alice";  # the user that wants to access a resource.
var obj = "data1";  # the resource that is going to be accessed.
var act = "read";  # the operation that the user performs on the resource.

if (await e.EnforceAsync(sub, obj, act))
{
    // permit alice to read data1
}
else
{
    // deny the request, show an error
}

C++

    casbin::Enforcer e("../assets/model.conf", "../assets/policy.csv");

    if (e.Enforce({"alice", "/alice_data/hello", "GET"})) {
        std::cout << "Enforce OK" << std::endl;
    } else {
        std::cout << "Enforce NOT Good" << std::endl;
    }

    if (e.Enforce({"alice", "/alice_data/hello", "POST"})) {
        std::cout << "Enforce OK" << std::endl;
    } else {
        std::cout << "Enforce NOT Good" << std::endl;
    }

Delphi

if casbin.enforce(['alice,data1,read']) then
  // Alice is super happy as she can read data1
else
  // Alice is sad

Rust

  let sub = "alice"; // the user that wants to access a resource.
  let obj = "data1"; // the resource that is going to be accessed.
  let act = "read"; // the operation that the user performs on the resource.

  if e.enforce((sub, obj, act)).await? {
      // permit alice to read data1
  } else {
      // error occurs
  }

Lua

if e:enforce("alice", "data1", "read") then
   -- permit alice to read data1
else
   -- deny the request, show an error
end

Casbinは、ランタイムでの権限管理のためのAPIも提供しています。 例えば、以下のようにユーザーに割り当てられたすべてのロールを取得することができます:

Go

roles, err := e.GetRolesForUser("alice")

Java

List<String> roles = e.getRolesForUser("alice");

Node.js

const roles = await e.getRolesForUser('alice');

PHP

$roles = $e->getRolesForUser("alice");

Python

roles = e.get_roles_for_user("alice")

.NET

var roles = e.GetRolesForUser("alice");

Delphi

roles = e.rolesForEntity("alice")

Rust

let roles = e.get_roles_for_user("alice");

Lua

local roles = e:GetRolesForUser("alice")

詳細な使用方法は、Management APIとRBAC APIを参照してください。

詳細な使用方法については、テストケースを参照してください。