It would be a great help if someone can help me out, i am building a custom system and want to implement the authorization with casbin (I'm new to casbin)
here is a system brief (cant share all details of the project, company project)
-
multi-tenant based system (tenants are divided logically)
-
Has mainly 3 roles
- super admin - can access call tenants and has all access
Tenant based role
- Admin - all access to allotted tenant data
- Member -> access only given to modules that are allotted (like feat1, feat2, ...etc)
Some IMP points
- User_A can be admin in tenant_A and member in tenant_B, thus same user can have different roles in different tenants
- Same role ("member") can have different access level (THUS cant use RBAC here)
NOW i also have API so
-
admin can get the API token and while creating api, give token access to features like feat1(READ), feat2(READ,CREATE)...
thus single can have 2 api tokens with different access levels -
features like feat1, feat2, feat3 remain same across all the tenants and example: user_module, user_info, ...
-
i require user_module.create, user_module.read in API access and not in the roles for the time being
Example
Tenant_A
- user_A - role:Member, access:feat1, feat4...
- user_B - role:Member, access:feat2, feat4...
- user_C - role:Admin, access:(all access for same tenant)
Tenant_B
- user_A - role:Admin, access:(all access for same tenant)
- user_B - role:Member, access:feat1, feat2
- user_D - role:Member, access:feat3
now i am confused what kind of model will work, is it possible to do with casbin
it would be a great help if someone can help me out
THANKS in advance
