Rules work on Casbin Editor but not on Casbin.Net
mari3728 opened this issue · comments
Hello,
I'm using latest stable Casbin.Net (version 1.13.0 as of now) and I'd like to add a rule "everyone on the domain belongs to the group". My scenario works on Casbin Editor but not on the code.
Here's my model, policies, request and code sample:
Model
Node: it's an RBAC model because I already use it for RBAC
[request_definition]
r = sub, dom, obj, act
[policy_definition]
p = sub, dom, obj, act, eft
[role_definition]
g = _, _, _
[policy_effect]
e = some(where (p.eft == allow)) && !some(where (p.eft == deny))
[matchers]
m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && regexMatch(r.obj, p.obj) && regexMatch(r.act, p.act)
Policies:
p, MyResourceName, domain-123, my-resourceId, access, allow
g, *, Team::TeamEveryoneKey, domain-123
g, Team::TeamEveryoneKey, MyResourceName, domain-123
Request
alice, domain-123, my-resourceId, access
Works on Casbin Editor:
Sample code in C#:
using System;
using NetCasbin;
using NetCasbin.Model;
using System.Linq;
using System.Text.RegularExpressions;
public class Program
{
public static void Main()
{
var modelText = @"[request_definition]
r = sub, dom, obj, act
[policy_definition]
p = sub, dom, obj, act, eft
[role_definition]
g = _, _, _
[policy_effect]
e = some(where (p.eft == allow)) && !some(where (p.eft == deny))
[matchers]
m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && regexMatch(r.obj, p.obj) && regexMatch(r.act, p.act)";
var casbinRules = @"
p, MyResourceName, domain-123, my-resourceId, access, allow
g, *, Team::TeamEveryoneKey, domain-123
g, Team::TeamEveryoneKey, MyResourceName, domain-123
";
var model = Model.CreateDefaultFromText(modelText);
var enforcer = new Enforcer(model);
enforcer.EnableAutoBuildRoleLinks(false);
var rules = Regex.Split(casbinRules, "\r\n|\r|\n");
var policies = rules.Where(l => l.StartsWith("p")).Select(x => x.Split(',').Skip(1).Select(y => y.Trim()).ToList()).ToList();
Console.WriteLine(string.Join(",", policies.SelectMany(p => p)));
enforcer.AddPolicies(policies);
var groups = rules.Where(l => l.StartsWith("g")).Select(x => x.Split(',').Skip(1).Select(y => y.Trim()).ToList()).ToList();
Console.WriteLine(string.Join(",", groups.SelectMany(p => p)));
Console.WriteLine(string.Join(",", groups));
enforcer.BuildRoleLinks();
var result = enforcer.EnforceEx("alice", "domain-123", "my-resourceId", "access");
Console.WriteLine(result.Result);
Console.WriteLine(result.Explains.FirstOrDefault());
}
}
Thanks in advance for the help!
@marifaleiros hi, we cannot reproduce your issue at: https://editor.casbin.org/#2CNB8XD9F , you can see the result is false
here. Please also share your editor page
@marifaleiros
@marifaleiros
Hi, as mentioned in the query above, the issue you raised is not reproduced in the online editor, but I have modified it to some extent, the link (https://editor.casbin.org/#7VRMT6ZLH), and I think this is the problem you are experiencing.
I guess there are three problems with your code, the first one about regular expression syntax, the second one about needing to register regular matching methods with the enforcer, and the third one maybe that you forgot to add the grouping policy.
The code that I think is correct is as follows, I hope it helps you.
// using System;
using NetCasbin;
using NetCasbin.Model;
// using System.Linq;
using System.Text.RegularExpressions;
// using System.Reflection;
using NetCasbin.Extensions;
using NetCasbin.Util;
// using NetCasbin.Util.Function;
public class Program
{
public static void Main()
{
var modelText = @"[request_definition]
r = sub, dom, obj, act
[policy_definition]
p = sub, dom, obj, act, eft
[role_definition]
g = _, _, _
[policy_effect]
e = some(where (p.eft == allow)) && !some(where (p.eft == deny))
[matchers]
m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && regexMatch(r.obj, p.obj) && regexMatch(r.act, p.act)";
var casbinRules = @"
p, MyResourceName, domain-123, my-resourceId, access, allow
g, .*, Team::TeamEveryoneKey, domain-123
g, Team::TeamEveryoneKey, MyResourceName, domain-123
";
// 1 (not '*' but '.*')
var model = Model.CreateDefaultFromText(modelText);
var enforcer = new Enforcer(model);
enforcer.EnableAutoBuildRoleLinks(false);
// 2 (https://casbin.org/zh/docs/rbac-with-pattern)
enforcer.AddNamedMatchingFunc("g", BuiltInFunctions.RegexMatch);
var rules = Regex.Split(casbinRules, "\r\n|\r|\n");
var policies = rules.Where(l => l.StartsWith("p")).Select(x => x.Split(',').Skip(1).Select(y => y.Trim()).ToList()).ToList();
Console.WriteLine(string.Join(",", policies.SelectMany(p => p)));
enforcer.AddPolicies(policies);
var groups = rules.Where(l => l.StartsWith("g")).Select(x => x.Split(',').Skip(1).Select(y => y.Trim()).ToList()).ToList();
Console.WriteLine(string.Join(",", groups.SelectMany(p => p)));
Console.WriteLine(string.Join(",", groups));
// 3 (Maybe you missed it)
enforcer.AddGroupingPolicies(groups);
enforcer.BuildRoleLinks();
var result = enforcer.EnforceEx("alice", "domain-123", "my-resourceId", "access");
Console.WriteLine(result.Result);
Console.WriteLine(result.Explains.FirstOrDefault());
}
}
@marifaleiros any update?
Closed as stale