Enforcing Casbin authZ at Envoy gateway level and multi-tenant modeling

Hi all, I’m integrating Casdoor in a microservices setup. I have multiple backend apps managing tenant-bound resources (e.g., vehicles), and I want unified user management and flexible authZ.

Currently, my system runs in Kubernetes behind an Envoy gateway, which enforces Authorization Code and Client Credentials flows on certain routes.

My question: is there a way to enforce both authN and authZ at the gateway level, letting it call Casbin directly? I’m using Casdoor’s built-in Casbin for permissions, and I’d like the backend apps to stay unaware—only letting requests pass if the user’s tenant matches the resource. Is this a sound approach?

Right now I use Envoy security policies (e.g., https://gateway.envoyproxy.io/docs/tasks/security/oidc/
). Could I add an extAuth policy to enforce Casbin checks? Most examples I see introduce a proxy—do you know any actively maintained, reliable ones?

Thanks in advance for any Casdoor-specific guidance!

I have another question about modeling tenants in Casdoor.

Most of my resources belong to a company, which maps well to tenants in my system. In Casdoor terms, should I model these as Organizations or User Groups?

Typically, permissions are the same across all organizations, although in the future some organizations may need custom rules.

What is the recommended best practice for this setup?

My concern with Organizations is that I need to duplicate applications, roles, and permissions per organization, which creates a lot of administrative overhead.

Would it be better to use groups and manage authorization mainly via Casbin, or is there a cleaner multi-tenant pattern for this use case?

Thanks in advance!

Hi! Is it possible to use UI defined roles in a custom enforcer policy without define the g rules manually? And what is the recommendation, should I use permissions or enforcer policies via the CRUD interface?
Thanks in advence!

@kurbly for gateway that works well with casdoor/casbin, you can use caswaf: https://github.com/casbin/caswaf

org is user pool. do you have the same user pool? if yes, then one org

Thank you for the answers!

I need shared applications, shared roles, and shared everything. A tenant essentially groups my users and manages company-specific attributes. If Casdoor organizations are not meant to be used for organization management in this way, then I will build my own backend for company-related metadata and identify tenants as Casdoor groups.

I am developing applications that are usable by multiple tenants. In general, tenant users have the same access rights, but they can only access their own resources (tenant isolation).

Thanks for the suggestion!

From what I understand, CasWAF is mainly a standalone reverse proxy / WAF with Casbin integration, rather than something that integrates directly with Envoy or the Kubernetes Gateway API as an authorization component.
My main goal is to enforce Casbin-based authorization at the gateway level in a cloud-native setup (Kubernetes + Gateway API + Envoy), using something like ext_authz or a similar mechanism, while keeping backend services unaware of authZ.

Is there any recommended pattern, reference architecture, or actively maintained solution for doing Casbin enforcement at the gateway layer in a Kubernetes-native environment?
For example, using Envoy external authorization with Casbin, or a Casdoor-integrated policy service.

Any guidance or best practices would be greatly appreciated.

Any ideas for that?