Supported Models
- ACL (Список контролю доступу)
- ACL з суперкористувачем
- ACL without users: Particularly useful for systems lacking authentication mechanisms or user login functionality.
- ACL without resources: Appropriate when permissions target resource types rather than individual resources. Examples include permissions like "write-article" and "read-log" that don't govern access to specific articles or logs.
- RBAC (Контроль доступу на основі ролей)
- RBAC with resource roles: Allows both users and resources to possess roles (or group memberships) simultaneously.
- RBAC with domains/tenants: Enables users to hold different role sets across different domains or tenants.
- ABAC (Attribute-Based Access Control): Utilizes convenient syntax like "resource.Owner" to access resource attributes.
- PBAC (Policy-Based Access Control): A versatile access control approach where authorization decisions derive from rule-based policies, enabling dynamic, context-aware access control.
- BLP (Bell-LaPadula): A formal state transition security model defining access control rules through security labels on objects and subject clearances.
- Biba (Biba Integrity Model): A security model controlling information flow to maintain data integrity and prevent unauthorized modifications.
- LBAC (Lattice-Based Access Control): A formal model merging confidentiality and integrity controls within a unified framework, using lattice structures for detailed access control decisions.
- OrBAC (Organisation-Based Access Control): Extends RBAC through abstraction layers separating concrete entities from abstract security policies, facilitating flexible multi-organizational access control.
- UCON (Usage Control): A modern access control model emphasizing ongoing authorization, mutable attributes, and a comprehensive framework encompassing authorizations, obligations, and conditions.
- RESTful: Handles path patterns such as "/res/*" and "/res/:id", along with HTTP methods including "GET", "POST", "PUT", and "DELETE".
- IP Match: Enables IP address-based matching for network-level access control.
- Deny-override: Accommodates both allow and deny authorizations, with deny taking precedence over allow.
- Priority: Permits prioritization of policy rules similar to firewall rule ordering.