An authorization library supporting ACL, RBAC, ABAC, and other access control models with a unified PERM metamodel.
Casbin is an open-source authorization library that enforces access control in applications using models like ACL, RBAC, and ABAC. It solves the problem of implementing flexible and maintainable authorization logic by abstracting policies into configurable rules. Developers can define who can access what resources under which conditions without hardcoding permissions.
Backend and full-stack developers building applications that require fine-grained permission systems, such as enterprise software, SaaS platforms, or microservices with complex user roles.
Casbin offers a unified, language-agnostic approach to authorization with support for multiple access control models, runtime policy management, and easy integration via middleware. Its configuration-driven design reduces code changes when updating authorization rules.
Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports ACL, RBAC, ABAC, RESTful, and combinations, allowing developers to switch or blend models via configuration files without code changes, as listed in the supported models section.
Available in Go, Java, Node.js, PHP, Python, .NET, C++, and Rust with production-ready implementations, enabling consistent authorization logic across diverse tech stacks.
Uses the PERM metamodel with CONF files to abstract authorization logic, making updates easy by modifying configuration rather than hardcoding permissions, as demonstrated in the examples.
Provides APIs for dynamic permission changes and a web-based UI for policy editing, facilitating real-time access control updates without redeployment.
Casbin explicitly handles only authorization, not authentication, requiring separate integration for user verification, which complicates the security stack and adds development effort.
The PERM metamodel and custom matchers involve a learning curve with specific syntax that can be error-prone, as noted in the documentation's caveats about operator usage and array handling.
While adapters are available, setting up and maintaining policy storage in databases or other backends adds operational complexity, especially for distributed systems needing consistency across nodes.