Using Casbin with Microsoft AD OIDC/OAuth login and JWT roles in SPA

Hi everyone! It's my first time using Casbin, and I'm not very experienced in implementing auth{n,z} systems either, so I would like a bit of help. I'm writing an API + SPA that needs to work with Microsoft login only (so no other system, password login, anything). Currently my understanding is that the OIDC / OAuth flow will be handled by the frontend (at least this is what ChatGPT told me to do) and once that is done the frontend will pass a JWT to the backend. How I need this to work is that user roles are defined and assigned in Microsoft AD, so the JWT would contain I guess the user's identity, and their authorized roles.

Here comes the relevant part: Once I have a user ID and a list of roles, how do I pass this to Casbin for authorization correctly? I want to be able to write policies based on roles, but also based on specific user IDs for exceptions.

One solution I've seen in a middleware implementation is that the user roles are tried in a for loop, passing each one to the enforcer to try to authorize it. I guess this works, but seems like it could cause problems in case of more complex rules, for example if there are deny rules.

The other solution I can think of is to use the RBAC APIs to call AddRolesForUser on every request on-demand, then DeleteRolesForUser at the end of every request (to prevent lingering roles in case the source of truth changes). Apart from this being a bit strange and seems kind of a misuse of the API, I'm also not sure this would be concurrency-safe. Currently I'm creating one enforcer at the startup of the service, and passing that around, I guess I could create one per request instead.

What would be really nice for this scenario is to be able to pass in a list of roles for the Enforce(...) call.

Creating one per request is gonna be so slow.

Actually, you should think of casbin as static ruleset for roles. Casbin should authorize based on the role and matchers.

Do not put your users in policy and fetch their role in middleware and enforce.

@antal.szabo are you using ADFS, AAD or AAD B2C?

First, you need to use Casdoor, which supports above all: https://casdoor.org/docs/provider/oauth/azureAD/ https://casdoor.org/docs/provider/oauth/adfs/

Casdoor also integrates with Casbin, so you just need to define your Casbin model and policy

Can casdoor integrate aws cognito?

All dirty work, like connecting AAD with Casdoor, or connecting Casdoor with Casbin, has been well handled

You only need to focus on business

yes. via protocols like oidc, oauth or saml

Isn't Casdoor a separate service to set up?

Yes

Casbin is just an auth lib, it doesn't handle AAD

If you don't use Casdoor, you can handle the connecting dirty work by yourself

I don't really want to add an additional layer of complexity/deployment here, so would prefer to do it directly

I already should have the list of roles from a jwt, or I can get them from Microsoft, that's alright; but how exactly do I call the Enforce API? Just call it with the role name as sub?

read casbin docs first

I did

what I found regarding this

Ask the Casbin AI: https://ai.casbin.com/

I thought this channel was for getting help...

This channel is not to teach you the docs

It's for more thoughtful discussions, which is not covered by docs or existing issues

I don't think you have even the basic knowledge about casbin

as I mentioned, I do not see an API where I could directly pass in a list of associated roles when calling Enforce, could you point me to where this is documented?

see g rules

that is right, hence why I'm asking for help

I'm not sure you understand what I'm asking

I guess I need a custom RoleManager probably