Overview
Conditions allow you to model more complex authorization modeling scenarios involving attributes and can be used to represent some Attribute-based Access Control (ABAC) policies. Take a look at the Conditions and Conditional Relationship Tuples concepts for a quick overview. There are various use cases where Conditions can be helpful. These include, but are not limited to:- Temporal Access Policies - manage user access for a window of time.
- IP Allowlists or Geo-fencing Policies - limit or grant access based on an IP Address range or corporate network policy.
- Usage-based/Feature-based Policies (Entitlements) - enforce quota or usage of some resource or feature.
- Resource-attribute Policies - define policies to access resources based on attributes/fields of the resource(s).
Defining conditions in models
For this example we’ll use the following authorization model to demonstrate a temporal based access policy. Namely, a user can view a document if and only if they have been granted the viewer relationship AND their non-expired grant policy is met.The type restriction for
document#viewer requires that any user of type user that is written in the relationship tuple must be accompanied by the non_expired_grant condition. This is denoted by the user with non_expired_grant specification.- Node.js
- Go
- .NET
- Python
- Java
- CLI
- curl
Writing conditional relationship tuples
Using the model above, when we Write relationship tuples to the OpenFGA store, then anydocument#viewer relationship with user objects must be accompanied by the condition non_expired_grant because the type restriction requires it.
For example, we can give user:anne viewer access to document:1 for 10 minutes by writing the following relationship tuple:
Queries with condition context
Now that we have written a Conditional Relationship Tuple, we can query OpenFGA using the Check API to see ifuser:anne has viewer access to document:1 under certain conditions/context. That is, user:anne should only have access if the current timestamp is less than the grant timestamp (e.g. the time which the tuple was written) plus the duration of the grant (10 minutes). If the current timestamp is less than, then you’ll get a permissive decision. For example,
but if the current time is outside the grant window then you get a deny decision. For example,
Similarly, we can use the ListObjects API to return all of the documents that user:anne has viewer access given the current time. For example,
but if the current time is outside the grant window then we don’t get the object in the response. For example,
When evaluating a condition at request time, the context written/persisted in the relationship tuple and the context provided at request time are merged together into a single evaluation context.If you provide a context value in the request context that is also written/persisted in the relationship tuple, then the context values written in the relationship tuple take precedence. That is, the merge strategy is such that persisted context has higher precedence than request context.
Examples
For more examples take a look at our Sample Stores repository. There are various examples with ABAC models in that repository.Supported parameter types
The following table enumerates the list of supported parameter types. The more formal list is defined in https://github.com/openfga/openfga/tree/main/internal/condition/types. Note that some of the types support generics, these types are indicated with<T>.
Limitations
-
The size of the condition
contextparameter that can be written alongside a relationship tuple is limited to 32KB in size. -
The size of the condition
contextparameter for query requests (e.g. Check, ListObjects, etc.) is not explicitly limited, but the OpenFGA server has an overall request size limit of 512KB at this time. - We enforce a maximum Google CEL expression evaluation cost of 100 (by default) to protect the server from malicious conditions. The evaluation cost of a CEL expression is a function of the size the input that is being compared and the composition of the expression. For more general information please see the official Language Definition for Google CEL. If you hit these limits with practical use-cases, please reach out to the maintainer team and we can discuss.