Apache Casbin is an open-source authorization library written in Go that enforces access control policies across applications. The library abstracts access control models into configuration files based on the PERM metamodel, which stands for Policy, Effect, Request, and Matchers. This design allows developers to switch or upgrade authorization mechanisms by simply modifying a configuration file rather than rewriting code.
The library supports multiple access control models including ACL (Access Control List), RBAC (Role-Based Access Control), and ABAC (Attribute-Based Access Control). Within these broad categories, Casbin provides specialized variants such as ACL with superuser support, RBAC with resource roles, RBAC with domains or tenants, RESTful access control with HTTP methods and path patterns, and deny-override authorization where deny rules take precedence over allow rules. The library also supports priority-based policy rules similar to firewall rule ordering.
Casbin's core functionality enforces policies in the classic subject-object-action form or custom forms defined by users. It handles storage of access control models and policies, manages role-user and role-role mappings for RBAC scenarios, supports built-in superuser roles, and includes multiple operators for rule matching such as keyMatch for pattern-based resource matching. The library explicitly does not handle authentication or manage user and role lists, as these are better managed by individual projects. It also does not function as a password container.
Casbin implementations exist across multiple programming languages including Java, Node.js, PHP, Python, .NET, C++, and Rust, all marked as production-ready. The project provides comprehensive tooling including a web-based online editor with syntax highlighting and code completion for writing models and policies, management APIs for runtime permission handling, RBAC-specific APIs for simplified code, and a web-based UI for model and policy management. The library also supports policy persistence through adapters and policy consistency across multiple nodes through watchers.
This cross-project involvement indicates the library's relevance across different technology ecosystems and its adoption by significant open-source initiatives.
