ladon

[Ladon](https://en.wikipedia.org/wiki/Ladon_%28mythology%29) is the serpent dragon protecting your resources. Ladon is a library written in [Go](https://golang.org) for access control policies, similar to [Role Based Access Control](https://en.wikipedia.org/wiki/Role-based_access_control) or [Access Control Lists](https://en.wikipedia.org/wiki/Access_control_list). In contrast to [ACL](https://en.wikipedia.org/wiki/Access_control_list) and [RBAC](https://en.wikipedia.org/wiki/Role-based_access_control) you get fine-grained access control with the ability to answer questions in complex environments such as multi-tenant or distributed applications and large organizations. Ladon is inspired by [AWS IAM Policies](http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html). Ladon officially ships with an exemplary in-memory storage implementations. Community-supported adapters are available for [CockroachDB](https://github.com/wehco/ladon-crdb). Ladon is now considered stable. --- ORY builds solutions for better internet security and accessibility. We have a couple more projects you might enjoy: * **[Hydra](https://github.com/ory/hydra)**, a security-first open source OAuth2 and OpenID Connect server for new and existing infrastructures that uses Ladon for access control. * **[ORY Editor](https://github.com/ory/editor)**, an extensible, modern WYSI editor for the web written in React. * **[Fosite](https://github.com/ory/fosite)**, an extensible security first OAuth 2.0 and OpenID Connect SDK for Go. * **[Dockertest](https://github.com/ory/dockertest)**: Write better integration tests with dockertest! --- **Table of Contents** - [Installation](#installation) - [Concepts](#concepts) - [Usage](#usage) - [Policies](#policies) - [Conditions](#conditions) - [CIDR Condition](#cidr-condition) - [String Equal Condition](#string-equal-condition) - [Boolean Condition](#boolean-condition) - [String Match Condition](#string-match-condition) - [Subject Condition](#subject-condition) - [String Pairs Equal Condition](#string-pairs-equal-condition) - [Resource Contains Condition](#resource-contains-condition) - [Adding Custom Conditions](#adding-custom-conditions) - [Persistence](#persistence) - [Access Control (Warden)](#access-control-warden) - [Audit Log (Warden)](#audit-log-warden) - [Metrics](#metrics) - [Limitations](#limitations) - [Regular expressions](#regular-expressions) - [Examples](#examples) - [Good to know](#good-to-know) - [Useful commands](#useful-commands) Ladon utilizes ory-am/dockertest for tests. Please refer to [ory-am/dockertest](https://github.com/ory-am/dockertest) for more information of how to setup testing environment. ## Installation This library works with Go 1.11+. ``` export GO111MODULE=on go get github.com/ory/ladon ``` Ladon uses [semantic versioning](http://semver.org/) and versions beginning with zero (`0.1.2`) might introduce backwards compatibility breaks with [each minor version](http://semver.org/#how-should-i-deal-with-revisions-in-the-0yz-initial-development-phase). ## Concepts Ladon is an access control library that answers the question: > **Who** is **able** to do **what** on **something** given some **context** * **Who**: An arbitrary unique subject name, for example "ken" or "printer-service.mydomain.com". * **Able**: The effect which can be either "allow" or "deny". * **What**: An arbitrary action name, for example "delete", "create" or "scoped:action:something". * **Something**: An arbitrary unique resource name, for example "something", "resources.articles.1234" or some uniform resource name like "urn:isbn:3827370191". * **Context**: The current context containing information about the environment such as the IP Address, request date, the resource owner name, the department ken is working in or any other information you want to pass along. (optional) To decide what the answer is, Ladon uses policy documents which can be represented as JSON ```json { "description": "One policy to rule them all.", "subjects": ["users:", "users:maria", "groups:admins"], "actions" : ["delete", ""], "effect": "allow", "resources": [ "resources:articles:<.*>", "resources:printer" ], "conditions": { "remoteIP": { "type": "CIDRCondition", "options": { "cidr": "192.168.0.1/16" } } } } ``` and can answer access requests that look like: ```json { "subject": "users:peter", "action" : "delete", "resource": "resources:articles:ladon-introduction", "context": { "remoteIP": "192.168.0.5" } } ``` However, Ladon does not come with a HTTP or server implementation. It does not restrict JSON either. We believe that it is your job to decide if you want to use Protobuf, RESTful, HTTP, AMQP, or some other protocol. It's up to you to write the server! The following example should give you an idea what a RESTful flow *could* look like. Initially we create a policy by POSTing it to an artificial HTTP endpoint: ``` … ``` Then we test if "peter" (ip: "192.168.0.5") is allowed to "delete" the "ladon-introduction" article: ``` > curl \ -X POST \ -H "Content-Type: application/json" \ -d@- \ "https://my-ladon-implementation.localhost/warden" <