abac

README

abac

Simple implementation for Attribute-Based Access Control (ABAC).

Install

go get github.com/yuriiiz/abac

Example

policy := Policy{
    Name:        "Name",
    Description: "Description",
    Statements: []Statement{
        {
            Effect:  Allow,
            Actions: []string{"read", "write", "audit"},
            Resources: Resources{
                ResourceType:  "resource_type_1",
                ResourceNames: []string{"*"},
                CompareFunc:   StrGlob,
            },
        },
        {
            Effect:  Allow,
            Actions: []string{"read", "write", "audit"},
            Resources: Resources{
                ResourceType:  "resource_type_2",
                ResourceNames: []string{"prefix_.*"},
                CompareFunc:   StrRegex,
            },
        },
        {
            Effect:  Deny,
            Actions: []string{"write"},
            Resources: Resources{
                ResourceType:  "resource_type_1",
                ResourceNames: []string{"resource_name_1", "resource_name_2", "resource_name_3"},
                CompareFunc:   StrEqual,
            },
            Conditions: Conditions{
                Items: []Condition{
                    {
                        Operator:      "gt",
                        AttributeType: AttributeTypeEnv,
                        AttributeKey:  "current_timestamp",
                        Value:         1600000000,
                    },
                    {
                        Operator:      "lt",
                        AttributeType: AttributeTypeEnv,
                        AttributeKey:  "current_timestamp",
                        Value:         1700000000,
                    },
                    {
                        Operator:      "eq",
                        AttributeType: AttributeTypeResource,
                        AttributeKey:  "environment",
                        Value:         "production",
                    },
                },
                Formula: "$0 and $1 and $2", // TODO: to be supported
            },
        },
    },
}

var resource Resource
var attributes Attributes

resource = Resource{
    ResourceType: "resource_type_1",
    ResourceName: "resource_name",
}
fmt.Println(policy.Validate("read", resource, attributes)) // -> nil

resource = Resource{
    ResourceType: "resource_type_2",
    ResourceName: "prefix_resource_name",
}
fmt.Println(policy.Validate("read", resource, attributes)) // -> nil

resource = Resource{
    ResourceType: "resource_type_2",
    ResourceName: "resource_name",
}
fmt.Println(policy.Validate("read", resource, attributes)) // -> ErrStatementNotMatch

resource = Resource{
    ResourceType: "resource_type_1",
    ResourceName: "resource_name_1",
}
attributes = []Attribute{
    {
        Type:      AttributeTypeResource,
        Key:       "environment",
        ValueType: "string",
        Value:     "production",
    },
    {
        Type:      AttributeTypeEnv,
        Key:       "current_timestamp",
        ValueType: "number",
        Value:     1650000000,
    },
}
fmt.Println(policy.Validate("write", resource, attributes)) // -> ErrDeniedByStatement

Documentation

Index

• Constants
• Variables
• func Compare(valueType, operator string, originValue, compareValue interface{}) (bool, error)
• func MatchStrPatterns(patterns []string, subj string, compareFunc StrComparable) bool
• func StrEqual(pattern, subj string) bool
• func StrGlob(pattern, subj string) bool
• func StrRegex(pattern, subj string) bool
• type Attribute
• type Attributes
• type Condition
• type Conditions
  • func (cs Conditions) Judge(attributes Attributes) (bool, error)
• type Identity
• type Permission
• type Policies
  • func (ps Policies) Validate(action string, resource Resource, attributes Attributes) error
• type Policy
  • func (p Policy) Validate(action string, resource Resource, attributes Attributes) error
• type Resource
• type Resources
  • func (r Resources) Match(resource Resource) bool
• type Statement
  • func (s Statement) Validate(action string, resource Resource, attributes Attributes) error
• type StrComparable

Constants

const (
	AttributeTypeSubject  = "AttributeTypeSubject"
	AttributeTypeResource = "AttributeTypeResource"
	AttributeTypeEnv      = "AttributeTypeEnv"
)

const (
	OperatorEQ         = "eq"
	OperatorLT         = "lt"
	OperatorLTE        = "lte"
	OperatorGT         = "gt"
	OperatorGTE        = "gte"
	OperatorNEQ        = "neq"
	OperatorGlobMatch  = "glob_match"
	OperatorRegexMatch = "regex_match"
)

const (
	Allow = "allow"
	Deny  = "deny"
)

Variables

var (
	ErrDeniedByStatement = errors.New("action denied as statement declared")
	ErrStatementNotMatch = errors.New("statement does not match the action")
)

Functions

func Compare

func Compare(valueType, operator string, originValue, compareValue interface{}) (bool, error)

func MatchStrPatterns

func MatchStrPatterns(patterns []string, subj string, compareFunc StrComparable) bool

func StrEqual

func StrEqual(pattern, subj string) bool

func StrGlob

func StrGlob(pattern, subj string) bool

func StrRegex

func StrRegex(pattern, subj string) bool

Types

type Attribute

type Attribute struct {
	Type      string // subject/resource/action/env
	Key       string
	ValueType string
	Value     interface{}
}

type Attributes

type Attributes []Attribute

type Condition

type Condition struct {
	Operator      string // equal/gt/lt
	AttributeType string
	AttributeKey  string
	Value         interface{}
}

type Conditions

type Conditions struct {
	Items   []Condition
	Formula string
}

func (Conditions) Judge

func (cs Conditions) Judge(attributes Attributes) (bool, error)

type Identity

type Identity struct {
	SubjectType string
	Subject     string
}

type Permission

type Permission struct {
	Policy
	Identity
}

type Policies

type Policies []Policy

func (Policies) Validate

func (ps Policies) Validate(action string, resource Resource, attributes Attributes) error

type Policy

type Policy struct {
	ID          uint64
	Name        string
	Description string
	Generated   bool
	Statements  []Statement
}

func (Policy) Validate

func (p Policy) Validate(action string, resource Resource, attributes Attributes) error

type Resource

type Resource struct {
	ResourceType string
	ResourceName string
}

type Resources

type Resources struct {
	ResourceType  string
	ResourceNames []string
	CompareFunc   StrComparable
}

func (Resources) Match

func (r Resources) Match(resource Resource) bool

type Statement

type Statement struct {
	Resources
	Effect     string
	Actions    []string
	Conditions Conditions
}

func (Statement) Validate

func (s Statement) Validate(action string, resource Resource, attributes Attributes) error

type StrComparable

type StrComparable func(pattern, subj string) bool