- Category
- Developer Tools
- Rank
- No. 162Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- apache
- GitHub
- 20.4k stars
- Latest release
- v3.11.0
- Date
About
Apache's authorization library supporting ACL, RBAC, ABAC, and other access-control models across 10+ programming languages.
What it does
Casbin embeds a policy decision engine inside an application. You describe requests, policies, effects, and matching rules in configuration, then ask the engine whether a subject may perform an action on an object. Policies can come from files or storage adapters and change at runtime.
Why it's ranked here
Casbin is a strong choice when authorization rules have outgrown scattered conditionals. Its configurable model combines roles, attributes, tenants, resource patterns, priorities, and explicit denials. Runtime policy management and pluggable persistence make it practical, while extensive model tests show attention to decision correctness.
What's good
The model cleanly separates request shape, policy shape, decision effect, and matching logic. Teams can mix roles with attributes, represent tenant-specific memberships, build role hierarchies, and prioritize rules. Policies support runtime additions and removals, while adapters, watchers, dispatchers, custom role managers, logging, and decision detectors provide useful integration points.
Tradeoffs
Configuration flexibility creates its own language to learn and test. Some expression behavior differs between language editions, and the documented Go membership operator can panic on a single-element array. Casbin does not authenticate users, store passwords, or own user and role directories. Optional AI explanations send decision context and policies to a configured external endpoint.
How to use it well
Use Casbin inside services that need one tested authorization layer across changing roles, attributes, tenants, resources, and actions. Keep model and policy cases under automated tests, use adapters for persistent policy, and place enforcement immediately before protected access. Pair it with separate authentication and identity management systems.
Technical notes+
The Go module is declared in go.mod as github.com/casbin/casbin/v3 and installs through the command documented in README.md. enforcer.go centers the library on Enforcer, loading models from CONF text and policies through persist.Adapter, then rebuilding role links and sorting policies during loads. rbac_api.go exposes direct and inherited role and permission management, while frontend.go serializes model and policy data for Casbin.js. ai_api.go adds AIConfig and Explain, which call EnforceEx and send request details, matched rules, matcher and effect text, and all policies to an OpenAI-compatible HTTP endpoint. Makefile runs linting plus race-enabled Go tests; abac_test.go, blp_test.go, biba_test.go, lbac_test.go, pbac_test.go, error_test.go, and model_test.go exercise multiple policy models and failure paths.
Observed
- License
- Apache License 2.0
- Primary language
- Go
- Packaging
- Go module github.com/casbin/casbin/v3, installed with go get
- Interface
- Embedded Go library with enforcement and runtime policy-management APIs
- Policy inputs
- CONF models plus policies loaded from files or persistence adapters
- Language ecosystem
- README lists production-ready Go, Java, Node.js, PHP, Python, .NET, C++, and Rust implementations
- Verification
- Makefile runs linting and race-enabled tests; repository text includes model and error test files
Read from README.md, go.mod, Makefile, ai_api.go, blp_test.go, enforcer.go, frontend.go, rbac_api.go, util_log.go, abac_test.go, biba_test.go, lbac_test.go, pbac_test.go, error_test.go, model_test.go.
What it can do
Implement Access Control Lists (ACL) authorization
User permissions and resource access rules → Authorization decisions for user access requests
Implement Role-Based Access Control (RBAC) authorization
User roles, permissions, and role assignments → Authorization decisions based on user roles
Implement Attribute-Based Access Control (ABAC) authorization
User attributes, resource attributes, and policy rules → Authorization decisions based on attribute evaluation
Enforce custom access control policies
Custom policy definitions and access requests → Allow/deny authorization decisions
Manage policy rules and permissions
Policy configuration files or rule definitions → Updated authorization policies
Integrate authorization across multiple programming languages
Application code in various languages (Go, Java, Python, etc.) → Cross-language authorization functionality
Validate user access requests in real-time
User identity, requested resource, and action type → Boolean authorization result (permit/deny)
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.