Ladon is the serpent dragon protecting your resources. A policy based authorization library written in Go. Ships with PostgreSQL for persistence.
Ladon is a authorization library. But you can also call it a policy administration and policy decision point. First, let's look at the policy layout:
{
// This should be a unique ID. This ID is required for database retrieval.
id: "68819e5a-738b-41ec-b03c-b58a1b19d043",
// A human readable description. Not required
description: "something humanly readable",
// Which identity does this policy affect?
// As you can see here, you can use regular expressions inside < >.
subjects: ["max", "peter", "<zac|ken>"],
// Should the policy allow or deny access?
effect: "allow",
// Which resources this policy affects.
// Again, you can put regular expressions in inside < >.
resources: ["urn:something:resource_a", "urn:something:resource_b", "urn:something:foo:<.+>"],
// Which permissions this policy affects. Supports RegExp
// Again, you can put regular expressions in inside < >.
permission: ["<create|delete>", "get"],
// Under which conditions this policy is active.
conditions: [
// Currently, only an exemplary SubjectIsOwner condition is available.
{
"op": "SubjectIsOwner"
}
]
}
Easy, right? To create such a policy do:
import github.com/ory-am/ladon/policy
var pol := &policy.DefaultPolicy{
ID: "68819e5a-738b-41ec-b03c-b58a1b19d043",
Description: "something humanly readable",
// ...
Conditions: []policy.Condition{
&policy.DefaultCondition{
Operator: "SubjectIsOwner",
},
},
}Let's see this in action! We're assuming that the passed policy has the same values as the policy layout.
import github.com/ory-am/ladon/guard
var guardian := new(guard.DefaultGuard)
granted, err := guardian.IsGranted("urn:something:resource_a", "delete", "ken", []policy.Policy{pol}, nil)
// if err != nil ...
log.Print(granted) // output: falseWhy is the output false? If we hadn't defined the SubjectIsOwner condition, isGranted would return true. But since we did, and we did not pass a context, the policy was not accountable for this set of properties and thus the return value is false. Let's try it again:
import github.com/ory-am/ladon/guard
import github.com/ory-am/ladon/guard/operator
var guardian := new(guard.DefaultGuard)
var ctx := operator.Context{
Owner: "ken"
}
granted, err := guardian.IsGranted("urn:something:resource_a", "delete", "ken", []policy.Policy{pol}, ctx)
// if err != nil ...
log.Print(granted) // output: truePlease be aware that all checks are case sensitive because subject values could be case sensitive IDs.