Casbin-CPP

Casbin abstracts access control into a configuration file (CONF) based on the PERM metamodel:

1. Request definition (r): Defines the structure of the request (e.g., sub, obj, act for subject, object, action).
2. Policy definition (p): Defines the structure of the stored policy rules.
3. Policy effect (e): Defines how the results of the matchers are combined (e.g., some(where (p.eft == allow)) means if any policy allows, the result is allow).
4. Matchers (m): Defines the logic used to match the request against the policies.

By modifying the CONF file, you can switch between different authorization mechanisms like ACL, RBAC, or ABAC without changing your application code.

# Request definition
[request_definition]
r = sub, obj, act

# Policy definition
[policy_definition]
p = sub, obj, act

# Policy effect
[policy_effect]
e = some(where (p.eft == allow))

# Matchers
[matchers]
m = r.sub == p.sub && r.obj == p.obj && r.act == p.act

To use Casbin-CPP in your C++ project, follow these steps:

1. Setup Include Path: Add the project's include directory to your system's PATH environment variable so that #include <casbin/casbin.h> is resolvable.
2. Initialize Enforcer: Create a casbin::Enforcer instance by providing paths to a model configuration file (.conf) and a policy file (.csv).
3. Enforce Permissions: Use the Enforce method to check if a request (subject, object, action) is permitted based on your loaded model and policies.
4. Runtime Management: Use the API to query permissions at runtime, such as retrieving implicit roles for a user.

#include <casbin/casbin.h>
#include <string>
#include <vector>

void IsAuthorized() {
    // 1. Initialize the enforcer with model and policy files
    casbin::Enforcer e("./path/to/model.conf", "./path/to/policy.csv");

    // 2. Define the request parameters
    std::string sub = "alice"; // the user
    std::string obj = "data1"; // the resource
    std::string act = "read"; // the operation

    // 3. Check permission
    if(e.Enforce({ sub, obj, act })) {
        // permit alice to read data1
    } else {
        // deny the request
    }

    // 4. Example of runtime permission management: get implicit roles
    std::vector<std::string> roles = e.GetImplicitRolesForUser(sub);
}

To perform authorization checks, import pycasbin and initialize a casbin.Enforcer with your model configuration and policy files. You can then call e.Enforce(req) to check if a request is authorized.

Request Formats: The Enforce method accepts requests in two primary formats:

• A list: ['subject', 'object', 'action']
• A dictionary: {"sub": "subject", "obj": "object", "act": "action"}

Enforcer Types:

• casbin.Enforcer: The standard enforcer.
• casbin.CachedEnforcer: An alternative for specific use cases requiring caching.

import pycasbin as casbin

# Initialize the enforcer with model and policy paths
e = casbin.Enforcer('path/to/model.conf', 'path/to/policy.csv')

# Check authorization using a list-based request
result = e.Enforce(['subject1', 'object1', 'action1'])

# Or using a dictionary-based request
result = e.Enforce({"sub": "subject1", "obj": "object1", "act": "action1"})

if result:
    print('Authorized')
else:
    print('Not authorized!')

If you do not want to install Casbin locally, you can integrate it directly into your project using CMake's FetchContent. This method automatically downloads and configures Casbin during your project's build process.

Requirements:

• CMake >= v3.19

Note that you can disable optional components like tests, benchmarks, or language bindings using specific CMake variables to speed up your build.

include(FetchContent)

FetchContent_Declare(
        casbin
        GIT_REPOSITORY https://github.com/casbin/casbin-cpp.git
        GIT_TAG v1.38.1
)

set(CASBIN_BUILD_TEST OFF)            # If you don't need to build tests for casbin
set(CASBIN_BUILD_BENCHMARK OFF)       # If you don't need to build benchmarks for casbin
set(CASBIN_BUILD_BINDINGS OFF)        # If you don't need language bindings provided by casbin
set(CASBIN_BUILD_PYTHON_BINDINGS OFF) # If you don't need python bindings for casbin

# Making casbin and its targets accessible to our project
FetchContent_MakeAvailable(casbin)

FetchContent_GetProperties(casbin)

# If casbin wasn't populated, then manually populate it
if(NOT casbin_POPULATED)
    FetchContent_Populate(casbin)
    add_subdirectory(${casbin_SOURCE_DIR} ${casbin_BINARY_DIR})
endif()

# Link against casbin
add_executable(myexec main.cpp)
target_link_libraries(myexec PRIVATE casbin::casbin)

The following table lists common access control models and their corresponding configuration and policy files available in the repository for reference: