Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Introduction

BAC Rules is a set of Rust libraries for evaluating access control policies, with a focus on FreeIPA and LDAP directory deployments. The libraries cover several access control models — HBAC, ABAC, RBAC, LDAP ACIs, POSIX ACLs, Windows Security Descriptors, and RFC 9396 authorization_details — and can be used from Rust, Python, or the browser via WebAssembly.

Crates

Core libraries

CratePurpose
acls-rsPermission primitives, RBAC with role inheritance, temporal permissions
hbac-rsFreeIPA Host-Based Access Control — three-dimensional matching (user × host × service)
abac-rsAttribute-Based Access Control with arbitrary typed dimensions
ldap-acisLDAP Access Control Instructions — parse, evaluate, generate, and transform ACIs for 389 DS and OpenLDAP
posix-aclsPOSIX.1e ACL modeling: typed permission model, ACL builder, access check algorithm, user/group model, acls-rs bridge
win-sdWindows Security Descriptor (MS-DTYP): SIDs, ACCESS_MASKs, 21 ACE types, SDDL parsing/generation, access check algorithm (integrity, privileges, restricted tokens), conditional ACEs, OBJECT_TYPE_LIST, claims, configurable PermissionMapping bridge
authz-details-rsRFC 9396 authorization_details for OAuth 2.0 Rich Authorization Requests: parsing, a JSON Schema type registry, named rules with JSONPath conditions and time windows, subset comparison with explanations, and delegation; composes with acls-rs RBAC and hbac-rs HBAC

Bindings

CratePurpose
acls-python, hbac-python, abac-python, posix-acls-python, win-sd-python, authz-details-pythonPython bindings via PyO3 with cross-module type sharing
abac-wasm, hbac-wasmWebAssembly packages for browsers and Node.js

Tools

CratePurpose
perf-testingBenchmark CLI with synthetic rule generation, fixture management, and scaling analysis
ldif-parserLDIF (RFC 2849) parser producing LdapEntry structures for ldap-acis

Access control models

  • RBAC (Role-Based Access Control) — permissions granted through roles with inheritance hierarchies
  • HBAC (Host-Based Access Control) — FreeIPA’s model for deciding whether a user may access a service on a host
  • ABAC (Attribute-Based Access Control) — policy decisions based on arbitrary attributes of the requester, resource, and environment
  • LDAP ACIs — fine-grained access control over directory entries and attributes, as used by 389 Directory Server and OpenLDAP
  • POSIX ACLs — POSIX.1e access control lists for file system permissions
  • Windows Security Descriptors — MS-DTYP security descriptors with SDDL, DACLs/SACLs, and mandatory integrity
  • RFC 9396 authorization details — OAuth 2.0 Rich Authorization Requests: structured, type-specific authorization grants with field-level policy, subset re-requests, and delegation

Project goals

  1. Correctness — permission composition follows well-defined algebraic rules so that grant/deny interactions behave predictably
  2. Performance — evaluation stays fast at scale through caching, indexing, and optional JIT compilation; see Performance Results for benchmark data
  3. Composability — combine HBAC, RBAC, and ABAC policies in a single evaluation
  4. Production use — designed for SSSD and enterprise identity deployments

Use cases

  • FreeIPA deployments — HBAC rule evaluation for identity management
  • SSSD integration — local caching and evaluation of access policies
  • Directory servers — ACI analysis, migration, and evaluation for 389 DS and OpenLDAP
  • Python applications — high-performance access control via Python bindings
  • Web applications — browser and Node.js support via WebAssembly
  • Samba/NFS interoperability — NT to POSIX ACL translation via the PermissionSet bridge
  • Active Directory — AD schema access control analysis with SDDL and LDAP ACI cross-model comparison
  • Payment APIs — OAuth 2.0 Rich Authorization Requests: validate, match, and delegate structured authorization_details for payment initiation and account information

Getting started

See the Installation guide to begin using BAC Rules.