This library is meant to implement the concept of ABAC in your PHP applications.
The concept is to manage access control using attributes : from users, from resources and environment.
It allows us to define rules based on the properties of the user object and optionally the accessed object.
These rules will be checked in your application to determine if an user is allowed to perform an action.
The following links explain what ABAC is :
Using composer :
Write the following line in your composer.json file :
"require" : {
"kilix/php-abac": "dev-master"
}
Then just do :
composer install
Then you will have to configure the attributes and the rules of your application.
For more details about this, please refer to the dedicated documentation
Example with only user attributes defined in the rule
We have in this example a single object, representing the current user.
This object have properties, with getter methods to access the values.
For example, we can code :
<?php
use PhpAbac\Abac;
class User{
protected $id;
protected $isBanned;
public function getId() {
return $this->id;
}
public function setIsBanned($isBanned) {
$this->isBanned = $isBanned;
return $this;
}
public function getIsBanned() {
return $this->isBanned;
}
}
$user = new User();
$user->setIsBanned(true);
$abac = new Abac([
'policy_rule_configuration.yml'
]);
$abac->enforce('create-group', $user);
The attributes checked by the rule can be :
User |
---|
isBanned = false |
Example with both user and object attributes
use PhpAbac\Abac;
$abac = new Abac([
'policy_rule_configuration.yml'
]);
$check = $abac->enforce('read-public-group', $user, $group);
The checked attributes can be :
User | Group |
---|---|
isBanned = 0 | isActive = 1 |
isPublic = 1 |
Example with dynamic attributes
<?php
use PhpAbac\Abac;
$abac = new Abac([
'policy_rule_configuration.yml'
]);
$check = $abac->enforce('edit-group', $user, $group, [
'dynamic-attributes' => [
'group-owner' => $user->getId()
]
]);
Example with cache
$check = $abac->enforce('edit-group', $user, $group, [
'cache_result' => true,
'cache_ttl' => 3600, // Time To Live in seconds
'cache_driver' => 'memory' // memory is the default driver, you can avoid this option
]);
If you want to contribute, don't hesitate to fork the library and submit Pull Requests.
You can also report issues, suggest enhancements, feel free to give advices and your feedback about this library.
It's not finished yet, there's still a lot of features to implement to make it better. If you want to be a part of this library improvement, let us know !