diff --git a/examples/rbac_with_abac_rule_model.conf b/examples/rbac_with_abac_rule_model.conf new file mode 100644 index 00000000..8de900b4 --- /dev/null +++ b/examples/rbac_with_abac_rule_model.conf @@ -0,0 +1,14 @@ +[request_definition] +r = sub, obj, act, ctx + +[policy_definition] +p = sub, obj, act, ctx_rule, eft + +[role_definition] +g = _, _ + +[policy_effect] +e = some(where (p.eft == allow)) && !some(where (p.eft == deny)) + +[matchers] +m = g(r.sub, p.sub) && (r.obj == p.obj) && (r.act == p.act || p.act == "*") && (p.ctx_rule == "noRule" || eval(p.ctx_rule)) \ No newline at end of file diff --git a/examples/rbac_with_abac_rule_policy.csv b/examples/rbac_with_abac_rule_policy.csv new file mode 100644 index 00000000..9ec53782 --- /dev/null +++ b/examples/rbac_with_abac_rule_policy.csv @@ -0,0 +1,14 @@ +p, admin, data1, read, noRule, allow +p, admin, data1, read, r.ctx.age < 18 || r.ctx.type == "minor", deny + +p, admin, data2, write, noRule, allow +p, admin, data2, write, r.ctx.network == "http", deny + +p, admin, data3, *, noRule, allow + +p, user, data4, read, noRule, allow +p, user, data4, read, r.ctx.RiskStatus == "high", deny + +g, alice, admin +g, alice, user +g, bob, admin \ No newline at end of file diff --git a/examples/rbac_with_abac_rule_request_example.csv b/examples/rbac_with_abac_rule_request_example.csv new file mode 100644 index 00000000..c9821986 --- /dev/null +++ b/examples/rbac_with_abac_rule_request_example.csv @@ -0,0 +1,9 @@ +alice, data1, read, {} +alice, data1, read, {"age":18,"type":"minor"} +alice, data2, read, {} +alice, data2, write, {} +alice, data2, write, {"network":"http"} +alice, data3, read, {} +alice, data3, write, {} +alice, data4, read, {} +alice, data4, read, {"RiskStatus":"high"} \ No newline at end of file