Hi! How can I use the Enforcer API with an application that is not related to a built-in organization? How can I control access for an application, given that client credentials identify the app rather than a user?
I recently upgraded my Casdoor version, and now my application that is not part of a built-in organization can no longer use the Enforcer API. What is the expected behavior in this case?
Hi!
In the exposed casbin API is there any way to use the user's ID instead of /?
I do not find this logical, why use a changeable string instead of an immuteble ID, which identifies the user? Or is there other usecases, where the sub is a different resource from a user?
Any ideas for that?
Thanks for the suggestion!
From what I understand, CasWAF is mainly a standalone reverse proxy / WAF with Casbin integration, rather than something that integrates directly with Envoy or the Kubernetes Gateway API as an authorization component.
My main goal is to enforce Casbin-based authorization at the gateway level in a cloud-native setup (Kubernetes + Gateway API + Envoy), using something like ext_authz or a similar mechanism, while keeping backend services unaware of authZ.
Is there any recommended pattern, reference architecture, or actively maintained solution for doing Casbin enforcement at the gateway layer in a Kubernetes-native environment?
For example, using Envoy external authorization with Casbin, or a Casdoor-integrated policy service.
Any guidance or best practices would be greatly appreciated.
Thank you for the answers!
I need shared applications, shared roles, and shared everything. A tenant essentially groups my users and manages company-specific attributes. If Casdoor organizations are not meant to be used for organization management in this way, then I will build my own backend for company-related metadata and identify tenants as Casdoor groups.
I am developing applications that are usable by multiple tenants. In general, tenant users have the same access rights, but they can only access their own resources (tenant isolation).
Hi! Is it possible to use UI defined roles in a custom enforcer policy without define the g rules manually? And what is the recommendation, should I use permissions or enforcer policies via the CRUD interface?
Thanks in advence!
I have another question about modeling tenants in Casdoor.
Most of my resources belong to a company, which maps well to tenants in my system. In Casdoor terms, should I model these as Organizations or User Groups?
Typically, permissions are the same across all organizations, although in the future some organizations may need custom rules.
What is the recommended best practice for this setup?
My concern with Organizations is that I need to duplicate applications, roles, and permissions per organization, which creates a lot of administrative overhead.
Would it be better to use groups and manage authorization mainly via Casbin, or is there a cleaner multi-tenant pattern for this use case?
Thanks in advance!
Hi all, I’m integrating Casdoor in a microservices setup. I have multiple backend apps managing tenant-bound resources (e.g., vehicles), and I want unified user management and flexible authZ.
Currently, my system runs in Kubernetes behind an Envoy gateway, which enforces Authorization Code and Client Credentials flows on certain routes.
My question: is there a way to enforce both authN and authZ at the gateway level, letting it call Casbin directly? I’m using Casdoor’s built-in Casbin for permissions, and I’d like the backend apps to stay unaware—only letting requests pass if the user’s tenant matches the resource. Is this a sound approach?
Right now I use Envoy security policies (e.g., https://gateway.envoyproxy.io/docs/tasks/security/oidc/
). Could I add an extAuth policy to enforce Casbin checks? Most examples I see introduce a proxy—do you know any actively maintained, reliable ones?
Thanks in advance for any Casdoor-specific guidance!
