https://github.com/casbin/caddy-authz
Caddy-authz is a middleware for Caddy that blocks or allows requests based on access control policies.
https://github.com/casbin/caddy-authz
abac access-control acl authorization caddy casbin filter middleware plugin rbac
Last synced: 2 months ago
JSON representation
Caddy-authz is a middleware for Caddy that blocks or allows requests based on access control policies.
- Host: GitHub
- URL: https://github.com/casbin/caddy-authz
- Owner: casbin
- License: apache-2.0
- Created: 2017-05-27T05:31:36.000Z (about 8 years ago)
- Default Branch: master
- Last Pushed: 2023-08-06T14:09:08.000Z (almost 2 years ago)
- Last Synced: 2024-10-29T22:37:41.902Z (7 months ago)
- Topics: abac, access-control, acl, authorization, caddy, casbin, filter, middleware, plugin, rbac
- Language: Go
- Homepage: https://caddyserver.com/docs/modules/http.handlers.authz
- Size: 128 KB
- Stars: 240
- Watchers: 4
- Forks: 16
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
Caddy-authz [](https://travis-ci.com/casbin/caddy-authz) [](https://coveralls.io/github/casbin/caddy-authz?branch=master) [](https://godoc.org/github.com/casbin/caddy-authz)
======
Caddy-authz is an authorization middleware for [Caddy](https://github.com/mholt/caddy), it's based on [https://github.com/casbin/casbin](https://github.com/casbin/casbin).
## Installation
go get github.com/casbin/caddy-authz
## Caddyfile syntax
```
localhost {
route {
authz "/folder/to/caddy_binary/authz_model.conf" "/folder/to/caddy_binary/authz_policy.csv"
}
respond "Hello, world!"
...
}
```
or
```
{
order authz before respond
}
localhost {
authz "/folder/to/caddy_binary/authz_model.conf" "/folder/to/caddy_binary/authz_policy.csv"
respond "Hello, world!"
...
}
```
The ``authz`` directive specifies the path to Casbin model file (.conf) and Casbin policy file (.csv). The Casbin model file describes access control models like ACL, RBAC, ABAC, etc. The Casbin policy file describes the authorization policy rules. For how to write these files, please refer to: https://github.com/casbin/casbin#get-started
## A working example
1. ``cd`` into the folder of ``caddy`` binary.
2. Put your Casbin model file [authz_model.conf](https://github.com/casbin/caddy-authz/blob/master/authz_model.conf) and Casbin policy file [authz_policy.csv](https://github.com/casbin/caddy-authz/blob/master/authz_policy.csv) into this folder.
3. Add ``authz`` directive to your Caddyfile like:
```
localhost:666 {
route {
authz "authz_model.conf" "authz_policy.csv"
}
respond "Hello, world!"
...
}
```
4. Run ``caddy`` and enjoy.
Note: This plugin only supports HTTP basic authentication to get the logged-in user name, if you use other kinds of authentication like OAuth, LDAP, etc, you may need to customize this plugin.
## How to control the access
The authorization determines a request based on ``{subject, object, action}``, which means what ``subject`` can perform what ``action`` on what ``object``. In this plugin, the meanings are:
1. ``subject``: the logged-on user name
2. ``object``: the URL path for the web resource like "dataset1/item1"
3. ``action``: HTTP method like GET, POST, PUT, DELETE, or the high-level actions you defined like "read-file", "write-blog"
For how to write authorization policy and other details, please refer to [the Casbin's documentation](https://github.com/casbin/casbin).
## Getting Help
- [Casbin](https://github.com/casbin/casbin)
## License
This project is under Apache 2.0 License. See the [LICENSE](LICENSE) file for the full license text.