Apache Casbin is an Apache-licensed authorization library for Go that helps developers enforce access control models such as ACL, RBAC, and ABAC inside their own applications rather than in a separate service.
What it is
Casbin is a library, not a running authorization server. It lives in the Go ecosystem as the package github.com/casbin/casbin/v2 and is published under the Apache-2.0 licence. Its stated purpose is to support enforcing authorization based on a range of access control models, and its topic list maps closely onto that goal: acl, abac, access-control, authz, authn, cas, and iam. The project is the reference implementation of a family of ports, with jCasbin for Java, node-Casbin for Node.js, php-casbin for PHP, PyCasbin for Python, Casbin.NET for .NET, Casbin-CPP for C++, and Casbin-RS for Rust.
The problem it solves is the one teams hit when authorization logic is scattered through application code as ad-hoc permission checks. Casbin replaces that hand-rolled logic with a policy-driven model that can be changed without rewriting the enforcement path. Instead of encoding each rule as a conditional in the application, a project defines a model and supplies policies, and Casbin evaluates requests against them. That separation is what makes the supported models — ACL, RBAC, and ABAC — interchangeable within the same library rather than three separate dependencies.
Key capabilities
- Enforces authorization against ACL, RBAC, and ABAC access control models.
- Ships as a Go module at
github.com/casbin/casbin/v2, documented on pkg.go.dev.
- Provides a policy management layer and a policy persistence layer, so policies can be stored and updated independently of application code.
- Addresses policy consistency between multiple nodes, which is the concern that arises when several application instances share one set of policies.
- Includes a role manager for handling role and inheritance relationships.
- Offers middleware integrations, with an examples collection and tutorials alongside them.
- Backs an online policy editor at https://casbin.apache.org/editor/, aimed at authors who need help writing correct Casbin policy.
Who uses it and how
- Go teams that want authorization enforced in-process, as a library dependency, rather than via a sidecar or a remote authorization service.
- Deployments running more than one node, where the same policy set must be consistent across every instance.
- Applications that need to switch or combine access control models — ACL, RBAC, ABAC — without changing the enforcement code.
- Software that integrates authorization at the HTTP or request layer through the middleware integrations the project documents.
- Organizations that maintain services in several languages, using the production-ready ports in Java, Node.js, PHP, Python, .NET, C++, and Rust with the same model concepts.
Getting started
Installation is covered in the README's Installation section, and the library is consumed as the Go module github.com/casbin/casbin/v2. Policy can also be drafted in the online editor before it is committed to a project.
How it compares
No list of paid products that Casbin replaces is provided here, so the useful comparison is within its own family: Casbin itself is the Go reference implementation, and jCasbin, node-Casbin, php-casbin, PyCasbin, Casbin.NET, Casbin-CPP, and Casbin-RS are the production-ready ports for their respective ecosystems. A team picks the port that matches its runtime and keeps the same model and policy concepts across services.
When to use it — and when not to
Casbin fits projects that want authorization to live inside the application and are willing to own the model and policy that drive it. A self-hoster must operate policy persistence and keep policies consistent across nodes, which is real work rather than a configuration detail. It is a poor fit for anyone who wants a ready-made authorization service with a user interface, and the information available here is thin: the README excerpt is truncated, the entry gives no release date, and the policy storage options a deployment would depend on are not enumerated, so those details need checking against the documentation before committing to it.
project readme (upstream, from github) — read inline
Apache Casbin
News: still worry about how to write the correct Apache Casbin policy? Apache Casbin online editor is coming to help! Try it at: https://casbin.apache.org/editor/
Apache Casbin is a powerful and efficient open-source access control library for Golang projects. It provides support for enforcing authorization based on various access control models.
All the languages supported by Apache Casbin:
Table of contents
Supported models
- ACL (Access Control List)
- ACL with superuser
- ACL without users: especially useful for systems that don't have authentication or user log-ins.
- ACL without resources: some scenarios may target for a type of resources instead of an individual resource by using permissions like
write-article, read-log. It doesn't control the access to a specific article or log.
- RBAC (Role-Based Access Control)
- RBAC with resource roles: both users and resources can have roles (or groups) at the same time.
- RBAC with domains/tenants: users can have different role sets for different domains/tenants.
- ABAC (Attribute-Based Access Control): syntax sugar like
resource.Owner can be used to get the attribute for a resource.
- RESTful: supports paths like
/res/*, /res/:id and HTTP methods like GET, POST, PUT, DELETE.
- Deny-override: both allow and deny authorizations are supported, deny overrides the allow.
- Priority: the policy rules can be prioritized like firewall rules.
How it works?
In Casbin, an access control model is abstracted into a CONF file based on the PERM metamodel (Policy, Effect, Request, Matchers). So switching or upgrading the authorization mechanism for a project is just as simple as modifying a configuration. You can customize your own access control model by combining the available models. For example, you can get RBAC roles and ABAC attributes together inside one model and share one set of policy rules.
The most basic and simplest model in Casbin is ACL. ACL's model CONF is:
# Request definition
[request_definition]
r = sub, obj, act
# Policy definition
[policy_definition]
p = sub, obj, act
# Policy effect
[policy_effect]
e = some(where (p.eft == allow))
# Matchers
[matchers]
m = r.sub == p.sub && r.obj == p.obj && r.act == p.act
An example policy for ACL model is like:
p, alice, data1, read
p, bob, data2, write
It means:
- alice can read data1
- bob can write data2
We also support multi-line mode by appending '\' in the end:
# Matchers
[matchers]
m = r.sub == p.sub && r.obj == p.obj \
&& r.act == p.act
Further more, if you are using ABAC, you can try operator in like following in Casbin golang edition (jCasbin and Node-Casbin are not supported yet):
# Matchers
[matchers]
m = r.obj == p.obj && r.act == p.act || r.obj in ('data2', 'data3')
But you SHOULD make sure that the length of the array is MORE than 1, otherwise there will cause it to panic.
For more operators, you may take a look at govaluate
Features
What Apache Casbin does:
- enforce the policy in the classic
{subject, object, action} form or a customized form as you defined, both allow a
