Wallogit.com
2017 © Pedro Peláez
Attribute based access control
A simple framework for implementing ABAC in your application., (*1)
Rules implement business logic, the input for rule execution consists of: - source: The actor, usually the current user - target: The subject, the entity that the actor wishes to act upon - permission: The action the actor wishes to take - environment: The environment should contain anything else the business rules may need, (*2)
Rules are encouraged to do recursive access check. A typical rule could be WriteImpliesRead, since for most systems when you can write an object you can also read it.
Implementation could look like this:, (*3)
public function execute(
object $source,
object $target,
string $permission,
Environment $environment,
AccessChecker $accessChecker
): bool {
return $permission === 'read' && $accessChecker->check($source, $target, 'write');
}
Consider a rule that allows access only during office hours. The current time should then be set in the environment. Reasoning behind this is that having 1 location for the environment allows for easy testing as well as a single source of truth., (*4)
Rules can contain infinite loops, we track recursion depth to detect these loops., (*5)