alex_35295

Hi, I have a task to integrate Casbin into a project.

There is a config:

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
g = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

And there are policy rules:

p, users-group1, WeatherForecast, GET
p, users-group2, WeatherForecast, POST

g, Alice, users-group1

Group membership such as g, Alice, users-group1 is provided in a JWT token from Keycloak.

Alice can access WeatherForecast with GET as expected, but the nuance is that the group membership (g, Alice, users-group1) is coming from the JWT token, and I need to configure access so that it's simple to define which groups can perform which actions:

p, users-group1, WeatherForecast, GET
p, users-group2, WeatherForecast, POST
However, if I remove g, Alice, users-group1 from the Casbin policy model, it stops working.