hbac-rs: HBAC Evaluation

Your organization has adopted FreeIPA for centralized identity management. Users, hosts, and services are all registered in the directory. Now you need to answer a new kind of question: can user Alice access the sshd service on host web01.example.com?

This is Host-Based Access Control (HBAC) – a three-dimensional access model where every decision depends on who is requesting access, which host they are targeting, and which service they want to use. All three dimensions must match for a rule to grant access.

hbac-rs provides idiomatic Rust types for HBAC rules, a policy engine with an integrated optimization pipeline, and deep integration with acls-rs for permissions, temporal rules, and RBAC composition.

Adding hbac-rs to your project

[dependencies]
hbac-rs = "0.1"
acls-rs = "0.1"

With serde support:

[dependencies]
hbac-rs = { version = "0.1", features = ["serde"] }

Basic usage

Create a rule that allows all users to SSH into a specific server, then evaluate a request:

#![allow(unused)]
fn main() {
use hbac_rs::prelude::*;
use acls_rs::Subject;

// Create an HBAC rule
let ssh_rule = HbacRule::builder("allow_ssh")
    .user_category_all()                                // any user
    .host("server.example.com")                         // this specific host
    .service("sshd")                                    // SSH service only
    .enabled(true)
    .build()
    .unwrap();

// Build a policy and load the rule
let mut policy = HbacPolicy::new();
policy.add_rule(ssh_rule);

// Evaluate an access request
let alice = Subject::new("alice");
let request = HbacRequest::new(alice, "server.example.com", "sshd");
let result = policy.evaluate(&request);

assert!(result.is_allowed());
}

The three dimensions

Each HBAC rule specifies matching criteria on three dimensions:

For each dimension, matching is either category=all (matches everything) or specific names and groups. A rule matches a request only when all three dimensions match.

HbacPolicy vs HbacPolicyLocal

hbac-rs provides two policy types:

• HbacPolicy – thread-safe (Send + Sync), backed by a Mutex. Use this when the policy is shared across threads (e.g., behind an Arc in a web server).
• HbacPolicyLocal – single-threaded, backed by a RefCell. Use this when the policy lives on one thread (e.g., in a CLI tool or benchmark harness). Avoids mutex overhead.

Both types share the same API. Choose based on your threading model.

Integration with acls-rs

hbac-rs builds on acls-rs types:

What to read next

• HBAC Rules – constructing rules for different access patterns: category=all, specific entities, groups, and deny rules.
• Policy Evaluation – how the engine decides: matching logic, deny precedence, evaluation methods, and debugging.
• Caching System – scaling to thousands of rules with sub-microsecond evaluation.
• SSSD Integration – deploying on FreeIPA-enrolled hosts with LDAP synchronization and disk persistence.
• Temporal Rules – maintenance windows, contractor access, and auto-expiring rules.
• Policy Composition – combining HBAC host access with RBAC application permissions.