Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

ABAC Rules

ABAC rules define access policies across arbitrary attribute dimensions. Each rule specifies matching criteria on one or more dimensions, a rule type (Allow/Deny), and an enabled status.

Creating rules

#![allow(unused)]
fn main() {
use abac_rs::{AbacRule, AttributeType};

let rule = AbacRule::builder("allow_engineers_prod_read")
    // User must be in engineers group
    .dimension_values("user", vec![
        AttributeType::String("group:engineers".into()),
    ])
    // Resource must be a production database
    .dimension_values("resource", vec![
        AttributeType::String("prod:db-01".into()),
        AttributeType::String("prod:db-02".into()),
    ])
    // Action must be read
    .dimension_values("action", vec![
        AttributeType::String("read".into()),
    ])
    .enabled(true)
    .build();
}

Rule types

  • Allow (default) – grants access if all dimensions match
  • Deny – blocks access if all dimensions match (takes precedence)
#![allow(unused)]
fn main() {
// Allow rule (default)
let rule = AbacRule::builder("allow_rule")
    // ... dimensions ...
    .enabled(true)
    .build();

// Deny rule
let rule = AbacRule::builder("deny_rule")
    .deny()
    // ... dimensions ...
    .enabled(true)
    .build();
}

Wildcard matching

Use AttributeValue::All to match any value for a dimension:

#![allow(unused)]
fn main() {
// Allow any user to read public data
let rule = AbacRule::builder("public_read")
    .dimension_all("user")
    .dimension_values("resource", vec![
        AttributeType::String("public:data".into()),
    ])
    .dimension_values("action", vec![
        AttributeType::String("read".into()),
    ])
    .enabled(true)
    .build();
}
#![allow(unused)]
fn main() {
// Any user can read public data
let rule = AbacRule::builder("public_read")
    .dimension_all("user")
    .dimension_values("resource", vec![
        AttributeType::String("public:data".into()),
    ])
    .dimension_values("action", vec![
        AttributeType::String("read".into()),
    ])
    .enabled(true)
    .build();
}

Multi-dimensional matching

A rule matches a request only when all dimensions match. This is an AND relationship – every dimension requirement must be satisfied.

See also