Anyone know if it is more efficient to have many role_definiton mappings or is it better to have many policy_definiton rules
So whats better:
g _, _, _
user,1 role_1, project_1
user1000, role_1, project_1
Or many policy definitons
policy_definitions:
r = sub, dom, act
user1, project1, read
...
user1000, project1, read
I can implement my usecase with both options. But from some benchmarks it seems that having many role_defintion mappings is more efficient.
To add some numbers to this: there can be 20000 role user mappings and just few lines of policy definitions
I also found this so that seems to verify what I found:
Grant permissions to RBAC roles instead of users directly. Casbin's RBAC is implemented by a role inheritance tree (as a cache). So, given a user like Alice, Casbin only takes O(1) time to query the RBAC tree for the role-user relationship and perform enforcement. If your g rules don't change often, then the RBAC tree won't need to be constantly updated. See the details of this discussion here: https://github.com/casbin/casbin/issues/681#issuecomment-763801583
