This is my confusion
keep it in memory, the policy has tenant info
if there is a new signup, I add to policy and restart?
I haven't tested database adapters yet, but does they query database on each request?
There is an opensource version available for casdoor as far as I know
This is already referred for testing.
in my case, I am trying to understand rbac with domain.
And my domains are my client's.
They should have their own set of roles
and it is read on each request?
The policy is hard coded in the example and as far as I can understand, casbin does not cache the change in database?
We are in microservice arch and there are instances of app that is running parallel.
So, few services fetch the updated roles, some don't
and that seems not possible with casbin for now. ?
@sang6196 how do you manage updated policies if there are more than one instance of service?
I was under the impression that a csv file would be enough if I have to just check roles permission with static policies. However, the thing is we are b2b saas and our customers would like to create users in their account
I don't know how to ask it correctly to gpt or google so here it goes:
I am trying rbac with domains. If I don't know my tenants beforehand and they signup to saas service, how would I handle policy.csv?
There are multiple services using that middleware so restarting all of them after each signup or forcing them to invalidate cache is not a good idea and probably difficult.
Is there a way to specify policy like: "Any user who has read access to that object in any domain"?
Antal, what he is trying to say is that nobody can spoonfeed each and every request on discord / slack. There is documentation for that.
You can ask specific question for example, when I started casbin yesterday, I was under the impression that its not suitable for highly dynamic saas environment that serves b2b2c customers.
Turns out, if the roles are static, you can extract them from any and use it to enforce. You do not need anything complex.
Can casdoor integrate aws cognito?
Creating one per request is gonna be so slow.
Actually, you should think of casbin as static ruleset for roles. Casbin should authorize based on the role and matchers.
Do not put your users in policy and fetch their role in middleware and enforce.
Thank you @hsluoyz
I am considering to use it in our two application:
- One requires usual owner access, and reseller access who can access multiple accounts
- Other app is multi-tenant where domain base rbac is required.
Hello, I am introduced to casbin today.
I was wondering if its the right tool to use for authorization in my small saas application?
I assume there should be a storage adapter to dynamically load policy on each request?
