Package: py-abac
py-ABACAttribute Based Access Control (ABAC) for python.IntroductionPy-ABAC is an attribute-based access control (ABAC) toolkit based on policies. ABAC gives you a fine-grained control on definition of the rules that restrict an access to resources and is generally considered a "next generation" authorization model. The design of py-ABAC stems from theXACMLstandard, and the ABAC python SDKVakt.Seedocumentationfor more details.InstallPyABAC runs on Python >= 3.5. PyPy implementation is supported as well.To install basic package run the following:pipinstallpy-abacWith the basic package the in-memory policy storage backend can be used. For the other persistent backends run:# MongoDB backendpipinstallpy-abac[mongo]# SQL backendpipinstallpy-abac[sql]Example UsageA quick dive-in:frompymongoimportMongoClientfrompy_abacimportPDP,Policy,AccessRequestfrompy_abac.storage.mongoimportMongoStorage# Policy definition in JSONpolicy_json={"uid":"1","description":"Max and Nina are allowed to create, delete, get any ""resources only if the client IP matches.","effect":"allow","rules":{"subject":[{"$.name":{"condition":"Equals","value":"Max"}},{"$.name":{"condition":"Equals","value":"Nina"}}],"resource":{"$.name":{"condition":"RegexMatch","value":".*"}},"action":[{"$.method":{"condition":"Equals","value":"create"}},{"$.method":{"condition":"Equals","value":"delete"}},{"$.method":{"condition":"Equals","value":"get"}}],"context":{"$.ip":{"condition":"CIDR","value":"127.0.0.1/32"}}},"targets":{},"priority":0}# Parse JSON and create policy objectpolicy=Policy.from_json(policy_json)# Setup policy storageclient=MongoClient()storage=MongoStorage(client)# Add policy to storagestorage.add(policy)# Create policy decision pointpdp=PDP(storage)# A sample access request JSONrequest_json={"subject":{"id":"","attributes":{"name":"Max"}},"resource":{"id":"","attributes":{"name":"myrn:example.com:resource:123"}},"action":{"id":"","attributes":{"method":"get"}},"context":{"ip":"127.0.0.1"}}# Parse JSON and create access request objectrequest=AccessRequest.from_json(request_json)# Check if access request is allowed. Evaluates to True since# Max is allowed to get any resource when client IP matches.assertpdp.is_allowed(request)DocumentationPy-ABAC documentation can be found athttps://py-abac.readthedocs.ioYou can also build the documentation by runningmake htmlinside thedocsfolder.Loggingpy-ABAC follows a common logging pattern for libraries:Its corresponding modules log all the events that happen but the log messages by default are handled byNullHandler. It's up to the outer code/application to provide desired log handlers, filters, levels, etc.For example:importloggingroot=logging.getLogger()root.setLevel(logging.INFO)root.addHandler(logging.StreamHandler())...# here go all the py_abac calls.MilestonesMost valuable features to be implemented in the order of importance:Sphinx DocumentationPolicy ObligationsIn-Memory StorageSQL StorageCaching mechanism for StorageFile StorageAcknowledgementsThe conceptual and implementation design of py-ABAC stems from theXACMLstandard and the ABAC python SDKVakt.Back to topDevelopmentPy-ABAC requires a few backend databases like MongoDB, MySQL, etc for testing and development. For convenience
adocker-composefile is provided in the test folder to spawn up the required infrastructure. Just run:$cdtests
$docker-composeup-d# this spawns up all the databases.$cd..# returns to the root repo folderTo hack py-ABAC run:$pipinstall-e.[dev]# to install all dependencies$pytest--cov=py_abactests/# to get coverage report$pylintpy_abac# to check code quality with PyLint$banditpy_abac# to check code security with BanditOptionally you can usemaketo perform development tasks.LicenseThe source code is licensed under Apache License Version 2.0ContributionsPull requests and bug reports always welcomed! :)