Authorization and Permissions (Casbin)
Relevant source files
The following files were used as context for generating this wiki page:
Casdoor utilizes Casbin as its core engine for managing authorization and access control. This system allows administrators to restrict user access to specific applications or resources within an organization by defining complex policies through models, adapters, and permissions.
The implementation provides a high-level abstraction over the standard Casbin engine, integrating it directly with Casdoor's multi-tenant architecture. It supports various resource types (Applications, TreeNodes, APIs, and Custom resources) and enables fine-grained control via users, roles, and groups.
Sources: web/src/TourConfig.js:154-159, object/permission.go:28-48
Permission Architecture
The permission system is built upon several key entities that define the "who, what, and how" of access control. The primary data structure is the Permission object, which links subjects (users, roles, groups) to specific actions on resources.
Permission Data Model
The Permission struct defines the schema for access rules:
| Field | Type | Description |
|---|---|---|
Owner | string | The organization that owns the permission. |
Name | string | Unique identifier for the permission. |
Users | []string | List of user IDs granted this permission. |
Roles | []string | List of role IDs granted this permission. |
Groups | []string | List of group IDs granted this permission. |
ResourceType | string | Type of resource (e.g., Application, API). |
Resources | []string | Target resource identifiers. |
Actions | []string | Allowed operations (Read, Write, Admin). |
Effect | string | The outcome of a match (Allow or Deny). |
State | string | Workflow state (Approved or Pending). |
Sources: object/permission.go:28-48, web/src/PermissionListPage.js:168-360
Policy Enforcement Flow
Casdoor intercepts requests using an authorization filter (ApiFilter) to verify if the subject has the necessary rights to perform an action on an object.
The ApiFilter identifies the subject and object of the request and queries the Casbin enforcer to determine if the operation is permitted.
Sources: routers/authz_filter.go:250-300, object/permission_enforcer.go:210-222
Casbin Integration and Management
Casdoor abstracts Casbin's complexity by providing automated enforcer initialization and policy synchronization.
The Enforcer Lifecycle
When checking permissions, Casdoor creates or retrieves a casbin.Enforcer instance. It dynamically loads the appropriate model and filtered policies based on the organization's configuration.
The enforcer is initialized with a model (often a default RBAC model) and uses an xorm-adapter to query policy rules from the permission_rule table.
Sources: object/permission_enforcer.go:25-60, object/permission_enforcer.go:343-376
Built-in Model Definition
If no custom model is specified, Casdoor uses a standard RBAC with domains model:
- Request definition:
r = sub, obj, act - Policy definition:
p = sub, obj, act, eft, "", permissionId - Role definition:
g = _, _ - Matchers: Matches based on roles, objects, and actions.
Sources: object/permission_enforcer.go:343-356
API and CLI Interfaces
Permission Management API
The backend provides several endpoints for programmatic permission control:
| Endpoint | Method | Description |
|---|---|---|
/api/get-permissions | GET | Retrieve permissions for an owner. |
/api/add-permission | POST | Create a new permission record. |
/api/update-permission | POST | Update existing permission and sync policies. |
/api/enforce | POST | Call the Casbin Enforce API directly. |
/api/batch-enforce | POST | Execute multiple enforcement checks. |
Sources: controllers/permission.go:28-140, swagger/swagger.yml:710-740
Casbin CLI Tooling
Casdoor includes a CLI integration (RunCasbinCommand) that allows developers to test Casbin logic across different languages (Go, Java, Python, Node, etc.). This tool supports verifying models and policies against specific requests directly from the UI or API.
Sources: controllers/casbin_cli_api.go:127-160
The system creates temporary configuration files for the model and policy to execute external CLI binaries safely.
Sources: controllers/casbin_cli_api.go:102-125, controllers/casbin_cli_api.go:162-210
Conclusion
The Authorization and Permissions system in Casdoor provides a robust framework for securing multi-tenant applications. By leveraging Casbin, it supports flexible policy definitions while maintaining performance through filtered policy loading and cached CLI results. This integration ensures that access control is both manageable through a web UI and enforceable across various application tiers.
Sources: object/permission_enforcer.go:25-45, web/src/PermissionEditPage.js:100-150