Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Quick Start

This guide will get you up and running with BAC Rules in 5 minutes.

acls-rs Quick Start

Basic Permission Usage

#![allow(unused)]
fn main() {
use acls_rs::prelude::*;

// Create a subject (user)
let mut alice = Subject::new("alice");

// Grant permissions
let read_file = AtomicPermission::new("file", "read");
let write_file = AtomicPermission::new("file", "write");

alice.grant(read_file);
alice.grant(write_file);

// Check permissions
assert!(alice.has_permission(&AtomicPermission::new("file", "read")));
assert!(alice.has_permission(&AtomicPermission::new("file", "write")));
}

RBAC Example

#![allow(unused)]
fn main() {
use acls_rs::prelude::*;

// Create roles
let mut developer_role = Role::new("developer", GrantDenialPair::empty());
developer_role.grant(AtomicPermission::new("code", "read"));
developer_role.grant(AtomicPermission::new("code", "write"));

let mut admin_role = Role::new("admin", GrantDenialPair::empty());
admin_role.grant(AtomicPermission::new("system", "admin"));

// Create RBAC policy
let mut policy = RbacPolicy::new();
policy.add_role(developer_role);
policy.add_role(admin_role);

// Assign roles to user
let mut user = Subject::new("bob");
user.roles.push("developer".to_string());

// Apply policy
policy.apply_to(&mut user);

// Check permissions
assert!(user.has_permission(&AtomicPermission::new("code", "read")));
}

hbac-rs Quick Start

Simple HBAC Rule

#![allow(unused)]
fn main() {
use hbac_rs::prelude::*;
use acls_rs::Subject;

// Create an HBAC rule
let ssh_rule = HbacRule::builder("allow_ssh")
    .user_category_all()               // All users
    .host_category_all()               // All hosts
    .service("sshd")                   // Only SSH service
    .enabled(true)
    .build()
    .unwrap();

// Create a policy and add rule
let mut policy = HbacPolicy::new();
policy.add_rule(ssh_rule);

// Create a request
let user = Subject::new("alice");
let request = HbacRequest::new(user, "server1.example.com", "sshd");

// Evaluate
let result = policy.evaluate(&request);
assert!(result.is_allowed());
}

Group-Based Rule

#![allow(unused)]
fn main() {
use hbac_rs::prelude::*;
use acls_rs::Subject;

// Create rule for admin group
let admin_rule = HbacRule::builder("admins_all_access")
    .user_group("admins")
    .host_category_all()
    .service_category_all()
    .enabled(true)
    .build()
    .unwrap();

let mut policy = HbacPolicy::new();
policy.add_rule(admin_rule);

// Create user with group membership
let mut alice = Subject::new("alice");
alice.roles.push("admins".to_string());

let request = HbacRequest::new(alice, "server1.example.com", "httpd");
let result = policy.evaluate(&request);

assert!(result.is_allowed());
}

abac-rs Quick Start

Simple ABAC Rule

#![allow(unused)]
fn main() {
use abac_rs::prelude::*;
use acls_rs::Subject;

// Create an ABAC rule
let rule = AbacRule::builder("allow_admin_access")
    .allow()
    .add_condition("role", "admin")
    .add_condition("department", "engineering")
    .enabled(true)
    .build()
    .unwrap();

// Create a policy and add rule
let mut policy = AbacPolicy::new();
policy.add_rule(rule);

// Create a request with attributes
let mut request = AbacRequest::new();
request.set_attribute("role", AttributeValue::String("admin".to_string()));
request.set_attribute("department", AttributeValue::String("engineering".to_string()));

// Evaluate
let result = policy.evaluate(&request);
assert!(result.is_allowed());
}

Multi-Type Attributes

#![allow(unused)]
fn main() {
use abac_rs::prelude::*;
use std::net::IpAddr;

// Create rule with IP address matching
let rule = AbacRule::builder("allow_from_trusted_network")
    .allow()
    .add_condition("source_ip", "10.0.0.0/8")
    .add_condition("port", 443)
    .enabled(true)
    .build()
    .unwrap();

let mut policy = AbacPolicy::new();
policy.add_rule(rule);

// Create request with typed attributes
let mut request = AbacRequest::new();
request.set_attribute("source_ip", AttributeValue::IpAddr("10.1.2.3".parse().unwrap()));
request.set_attribute("port", AttributeValue::Integer(443));

let result = policy.evaluate(&request);
assert!(result.is_allowed());
}

Performance Testing Quick Start

Generate Test Fixtures

# Generate 1000 HBAC rules with SSSD production distribution
bac-perf generate --count 1000 --output hbac_1k_prod --distribution sssd-prod

# Generate 100 rules for development
bac-perf generate --count 100 --output hbac_100_dev --distribution dev

Run Benchmarks

# Run all scenarios with caching
bac-perf bench --fixture hbac_1k_prod --scenario all --cache

# Run single latency test
bac-perf bench --fixture hbac_100_dev --scenario single-latency

# Save results as JSON
bac-perf bench --fixture hbac_1k_prod --scenario throughput \\
  --cache --format json --output results/

List Fixtures

# List all fixtures
bac-perf list

# Show detailed information
bac-perf list --verbose

Next Steps