Pure permission groups assignable for specific domains/groups/tenants

Hi there,

I’m looking for a way to create groups with non specific permissions. e.g. Admin -> * -> write and the ability to assign these groups to specific domains.

How would I go about this?

https://github.com/casbin/node-casbin/blob/master/examples/rbac_with_domains_policy.csv This example is creating a group for every domain, I would like to each group only once and control the domain access when the group assigned to users. e.g.

p, group_admin, subject_blog, permission_read
g, user_a, group_admin, domain_7

Is this possible?

[dwang7]

@slind14 @hsluoyz @nodece

Can you explain why this isn’t supported?

I created this model file and it seems to work fine.

[request_definition]
r = sub, dom, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
g = _, _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub, r.dom) && r.obj == p.obj && r.act == p.act

============================================================

p, read_role, data1, read
p, read_role, data2, read
p, write_role, data1, write
p, write_role, data2, write

g, alice, read_role, pepsi
g, alice, write_role, coke

============================================

domain is assigned in the group and not in the policy.

Enforcement works with this model.

[dwang7]

@hsluoyz

This is just an initial commit. Wanted to get some feedback on my implementation. Its not optimized for large data sets yet.

Basically, I’ve added a new ptype, d, which is domain_groups.

https://github.com/dwang7/pycasbin/blob/master/examples/rbac_with_domain_groups_model.conf https://github.com/dwang7/pycasbin/blob/master/examples/rbac_with_domain_groups_policy.csv

When you add to the roles, g, you can specify the domain_group instead of the domain.

g, bob, read_role, beverages

d, pepsi, beverages d, coke, beverages d, sprite, beverages