The method of using Casbin to control the authority of RBAC and RESTful in PHP

This article introduces the relevant knowledge of "PHP uses Casbin to do RBAC and RESTful access control". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

PHP-Casbin is a powerful and efficient open source access control framework that supports rights management based on various access control models (RBAC ABAC ACL).

Here use the official database adapter extension: DBAL Adapter.

Installation

Install via composer:

Composer require casbin/casbincomposer require casbin/dbal-adapter uses RBAC Model

Model.conf is as follows:

[request_definition] r = sub, obj, act [policy _ definition] p = sub, obj, act# RBAC definition of role inheritance relationship [role_definition] g = _, _ [policy_effect] e = some (where (p.eft = = allow)) [matchers] m = g (r.sub, p.sub) & & keyMatch3 (r.obj, p.obj) & & regexMatch (r.act, p.act) initializes a Casbin enforceruse Casbin\ Enforcer;use CasbinAdapter\ DBAL\ Adapter $adapter = Adapter::newAdapter (['driver' = >' pdo_mysql', 'host' = >' 127.0.0.1 policies, 'dbname' = >' test', 'user' = >' root', 'password' = >', 'port' = >' 3306 policies,]); $enforcer = new Enforcer ('path/to/model.conf', $adapter); add policies

Assign roles to alice and bob:

/ / alice has the admin role$enforcer- > addRoleForUser ('alice',' admin'); / / bob has the member role$enforcer- > addRoleForUser ('bob',' member')

Assign permissions to the member role, and the member role only has permission to view foo resources:

$enforcer- > addPermissionForUser ('member',' / foo', 'GET'); $enforcer- > addPermissionForUser (' member','/ foo/:id', 'GET')

The admin role has the permission to add, delete, modify and query foo:

/ / admin inherits all permissions of member$enforcer- > addRoleForUser ('admin',' member'); $enforcer- > addPermissionForUser ('admin',' / foo', 'POST'); $enforcer- > addPermissionForUser (' admin','/ foo/:id', 'PUT'); $enforcer- > addPermissionForUser (' admin','/ foo/:id', 'DELETE')

After the roles and permissions are assigned, the policy rules in the database are roughly as follows:

G, alice, adming, bob, memberp, memeber, / foo, GETp, memeber, / foo/:id, GETg, admin, memberp, admin, / foo, POSTp, admin, / foo/:id, PUTp, admin, / foo/:id, DELETE authentication permissions

Alice has the admin role and inherits all permissions of admin and member roles.

$enforcer- > enforce ('alice',' / foo', 'GET'); / / true$enforcer- > enforce (' alice','/ foo', 'GET'); / / true$enforcer- > enforce (' alice','/ foo', 'POST'); / / true$enforcer- > enforce (' alice','/ foo/1', 'PUT'); / / true$enforcer- > enforce (' alice','/ foo/1', 'DELETE'); / / true

Bob has the role of member and inherits only the permissions of member.

Enforcer- > enforce ('bob',' / foo', 'GET'); / / true$enforcer- > enforce (' bob','/ foo', 'GET'); / / true$enforcer- > enforce (' bob','/ foo', 'POST'); / / false$enforcer- > enforce (' bob','/ foo/1', 'PUT'); / / false$enforcer- > enforce (' bob','/ foo/1', 'DELETE') / / false, this is the end of the introduction of "PHP's method of using Casbin to do RBAC and RESTful access control". Thank you for reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!