Generating Test Fixtures

Before benchmarking, you need a rule set that reflects your production environment. The bac-perf generate command synthesizes HBAC and ABAC rules with configurable distributions, entity pools, and seeded randomness so that benchmarks are both realistic and reproducible.

Basic generation

# Generate HBAC fixture
bac-perf generate --bac-type hbac --count 1000 --output hbac_1k_prod \
  --distribution sssd-prod

# Generate ABAC fixture (same distributions apply)
bac-perf generate --bac-type abac --count 1000 --output abac_1k_prod \
  --distribution sssd-prod

This creates fixtures/{name}.json.gz – a gzip-compressed JSON file containing 1,000 rules, entity pools (HBAC only), and generation metadata.

Distribution presets

Presets control how rules are distributed across the five generation patterns (universal-allow, user-specific, host-specific, service-specific, fully-specific) and how often category=all, deny rules, and disabled rules appear.

sssd-prod

Models a production SSSD deployment: most rules target specific entities with dense group membership.

• 15% user category=all, 30% host category=all, 40% service category=all
• 5% deny rules, 2% disabled rules
• Average 10 groups per dimension

dev

Models a development environment: permissive rules, many category=all dimensions.

• 40% user category=all, 50% host category=all, 60% service category=all
• 1% deny rules, 5% disabled rules
• Average 3 groups per dimension

high-security

Models a high-security environment: very specific rules with many explicit denials.

• 5% user category=all, 10% host category=all, 15% service category=all
• 20% deny rules, 1% disabled rules
• Average 1-2 entities per dimension

Reproducibility

Use --seed for deterministic generation. The same seed, count, distribution, and BAC type always produce identical rules:

bac-perf generate --bac-type hbac --count 1000 --seed 42 --output run_a
bac-perf generate --bac-type hbac --count 1000 --seed 42 --output run_b
# run_a.json.gz and run_b.json.gz are identical

This is essential for regression testing: benchmark against the same fixture before and after a code change to isolate the performance impact.

HBAC vs ABAC fixtures

Both fixture types use the same distribution presets, but differ in structure:

ABAC fixtures use the same distributions but map them to ABAC’s generic dimension model:

• user dimension (same as HBAC)
• resource dimension (equivalent to HBAC’s targethost)
• action dimension (equivalent to HBAC’s service)

This mapping preserves statistical properties while allowing ABAC benchmarks.

Entity pools

Generated rules draw from pools of synthetic entities:

Pool sizes are fixed by the preset. Entity names follow the pattern user_0001, host_0001, etc.

Output format

Fixtures are compressed JSON files with this structure:

{
  "version": "1.0",
  "bac_type": "hbac",
  "metadata": {
    "generated_at": "2025-01-20T10:30:00Z",
    "rule_count": 1000,
    "synthesis_config": {
      "seed": 42,
      "distributions": { "..." }
    },
    "entity_pools": {
      "users": ["user_0001", "..."],
      "hosts": ["host_0001", "..."]
    }
  },
  "rules": [
    {
      "name": "rule_0001",
      "enabled": true,
      "user_category": "all",
      "..."
    }
  ]
}

Gzip compression reduces storage significantly (e.g., 1K rules: ~500 KB uncompressed to ~17 KB compressed).

Fixture management

# List all fixtures
bac-perf list

# Show detailed information (rule count, size, generation date)
bac-perf list --verbose

# Validate fixture integrity
bac-perf validate hbac_1k_prod

# Delete a fixture
rm fixtures/hbac_1k_prod.json.gz

Generating a test suite

A standard suite covers the range from quick tests to stress tests:

# HBAC fixtures
for size in 100 1000 10000 100000; do
  bac-perf generate \
    --bac-type hbac \
    --count $size \
    --distribution sssd-prod \
    --output hbac_${size}_baseline \
    --seed 42
done

# ABAC fixtures (optional, for native ABAC benchmarks)
for size in 100 1000 10000; do
  bac-perf generate \
    --bac-type abac \
    --count $size \
    --distribution sssd-prod \
    --output abac_${size}_baseline \
    --seed 42
done

Tip: You don’t need separate ABAC fixtures to benchmark ABAC performance. ABAC can benchmark HBAC fixtures directly through automatic conversion. See Cross-BAC Benchmarking.

Next steps

With fixtures generated, run benchmarks to measure latency, throughput, and memory under controlled conditions.

See Running Benchmarks.