Generating Test Fixtures

Before benchmarking, you need a rule set that reflects your production environment. The bac-perf generate command synthesizes HBAC, ABAC, LDAP ACI, POSIX ACL, and Windows SD rules with configurable distributions, entity pools, and seeded randomness so that benchmarks are both realistic and reproducible.

Basic generation

# Generate HBAC fixture
bac-perf generate --bac-type hbac --count 1000 --output hbac_1k_prod \
  --distribution sssd-prod

# Generate ABAC fixture (same distributions apply)
bac-perf generate --bac-type abac --count 1000 --output abac_1k_prod \
  --distribution sssd-prod

# Generate LDAP ACI, POSIX ACL, or Windows SD fixtures the same way
bac-perf generate --bac-type ldap_aci --count 1000 --output ldap_1k_prod --distribution sssd-prod
bac-perf generate --bac-type posix_acl --count 1000 --output posix_1k_prod --distribution sssd-prod
bac-perf generate --bac-type win_sd --count 1000 --output winsd_1k_prod --distribution sssd-prod

This creates fixtures/{name}.json.gz – a gzip-compressed JSON file containing 1,000 rules, entity pools (HBAC only), and generation metadata.

Distribution presets

Presets control how rules are distributed across the five generation patterns (universal-allow, user-specific, host-specific, service-specific, fully-specific) and how often category=all, deny rules, and disabled rules appear.

sssd-prod

Models a production SSSD deployment: most rules target specific entities with dense group membership.

• 15% user category=all, 30% host category=all, 40% service category=all
• 5% deny rules, 2% disabled rules
• Average 10 groups per dimension

dev

Models a development environment: permissive rules, many category=all dimensions.

• 40% user category=all, 50% host category=all, 60% service category=all
• 1% deny rules, 5% disabled rules
• Average 3 groups per dimension

high-security

Models a high-security environment: very specific rules with many explicit denials.

• 5% user category=all, 10% host category=all, 15% service category=all
• 20% deny rules, 1% disabled rules
• Average 1-2 entities per dimension

LDAP ACI, POSIX ACL, and Windows SD accept the same three preset names, but only the deny-rule ratio carries over to those generators; the rest of the rule-pattern mix (read/write/admin/inheritance patterns, etc.) is fixed internally for each generator.

Reproducibility

Use --seed for deterministic generation. The same seed, count, distribution, and BAC type always produce identical rules:

bac-perf generate --bac-type hbac --count 1000 --seed 42 --output run_a
bac-perf generate --bac-type hbac --count 1000 --seed 42 --output run_b
# run_a.json.gz and run_b.json.gz are identical

This is essential for regression testing: benchmark against the same fixture before and after a code change to isolate the performance impact.

HBAC vs ABAC fixtures

Both fixture types use the same distribution presets, but differ in structure:

ABAC fixtures use the same distributions but map them to ABAC’s generic dimension model:

• user dimension (same as HBAC)
• resource dimension (equivalent to HBAC’s targethost)
• action dimension (equivalent to HBAC’s service)

This mapping preserves statistical properties while allowing ABAC benchmarks.

LDAP ACI, POSIX ACL, and Windows SD fixtures use their own native rule structures (ACIs, POSIX ACL entries, and security descriptors respectively) generated directly from the same distribution presets – they are not part of the HBAC/ABAC mapping described above.

Entity pools

Generated rules draw from pools of synthetic entities:

Pool sizes are fixed by the preset. Entity names follow patterns like user0000 and host000.example.com; services are drawn from a pool of realistic names (sshd, httpd, postgresql, …) rather than generic placeholders.

Output format

Fixtures are compressed JSON files with this structure:

{
  "version": "1.0",
  "bac_type": "hbac",
  "metadata": {
    "generated_at": "2025-01-20T10:30:00Z",
    "rule_count": 1000,
    "synthesis_config": {
      "seed": 42,
      "distributions": { "..." }
    },
    "entity_pools": {
      "users": ["user0000", "..."],
      "hosts": ["host000.example.com", "..."]
    }
  },
  "rules": [
    {
      "name": "rule_00000",
      "enabled": true,
      "user_category": "all",
      "..."
    }
  ]
}

Gzip compression reduces storage significantly (e.g., 1K rules: ~500 KB uncompressed to ~17 KB compressed).

Fixture management

# List all fixtures
bac-perf list

# Show detailed information (rule count, size, generation date)
bac-perf list --verbose

# Validate fixture integrity
bac-perf validate hbac_1k_prod

# Delete a fixture
rm fixtures/hbac_1k_prod.json.gz

Generating a test suite

A standard suite covers the range from quick tests to stress tests:

# HBAC fixtures
for size in 100 1000 10000 100000; do
  bac-perf generate \
    --bac-type hbac \
    --count $size \
    --distribution sssd-prod \
    --output hbac_${size}_baseline \
    --seed 42
done

# ABAC fixtures (optional, for native ABAC benchmarks)
for size in 100 1000 10000; do
  bac-perf generate \
    --bac-type abac \
    --count $size \
    --distribution sssd-prod \
    --output abac_${size}_baseline \
    --seed 42
done

Tip: You don’t need separate ABAC fixtures to benchmark ABAC performance. ABAC can benchmark HBAC fixtures directly through automatic conversion. See Cross-BAC Benchmarking.

Next steps

With fixtures generated, run benchmarks to measure latency, throughput, and memory under controlled conditions.

See Running Benchmarks.