Lion Cipher Lab
Enforce multi-tenant RBAC with Casbin (RBAC with domains) -- and test it like code
- Identity & Access Management
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Broken access control is the top risk in both the OWASP Top 10 and the OWASP API Security Top 10, and multi-tenant software (one app serving many customer companies) turns a small authorization slip into one customer reading another customer's data. Libraries like Casbin make the rules short and readable, but a single missing clause in the rules, or a single route that never asks the library, quietly reopens the hole. This lab teaches the habit that actually prevents that: a table of expected decisions you run like any other test, so a leak shows up as a red test before it ships.
What you'll learn
- explaining RBAC with domains: one person, different roles in different tenants
- reading and writing a Casbin model file (request, policy, role, effect, matcher)
- writing a deny-override rule that beats even an admin role
- writing a table-driven authorization test suite that checks the denies, not only the allows
- measuring how one missing matcher clause or one missing role-definition field leaks across tenants
- choosing between keyMatch, keyMatch2 and regexMatch for REST paths, from observed behavior
- wiring enforcement centrally so a forgotten check on one route cannot happen
- authorizing the exact canonical path the router serves
- judging when an in-process library fits versus OPA, Cedar or OpenFGA
Steps in this lab
- What you are building, and the words you need
- Set up: open a terminal, check Python, install pycasbin
- Write the model: model.conf, one section at a time
- Write the policy: two tenants that deliberately differ
- Write the test table and run it: 39 decisions, green
- Bug 1: a matcher that forgets r.dom == p.dom
- Bug 2: role definition g = _, _ (the domain silently vanishes)
- Bug 3: path matching surprises (keyMatch vs keyMatch2 vs regexMatch)
- The bug Casbin cannot see: a route that never asks
- The policy store is part of the attack surface
- When Casbin fits, and when OPA, Cedar or OpenFGA fit better
- Honest negatives, and the habit to keep