Access Control

[imadmoussa1]

First check

• I used the GitHub search to find a similar issue and didn't find it.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I searched the FastAPI documentation, with the integrated search.

Description

I started using fastapi from 2 months, and this API is very useful for ML Models, But till now I did not found an Access Control for fastAPI, I search for RBAC (role-based access control) and ABAC ( attributes based access control) but I did not found a way to implement one of those methods.

How can I implement ABAC or RBAC with fastapi ?

Thank you

[devonhk]

Just my 2 cents, but I'm not sure providing an RBAC system is in the scope of this project.

[tiangolo]

@imadmoussa1 that's normally divided into 2 (or more) parts.

First, your database would have some data about who has some role, attribute, or is in a list, etc. That's all database dependent, so it would depend on your database, your ORM, etc. You can use anyone you want with FastAPI.

The other part is defining authorization in your endpoints. The standard for that is OAuth2 with scopes. Each scope represents a permission. You could implement those permissions based on roles, access control lists, attributes or anything else you want. But in the end, you would declare that to use some endpoint the client has to (somehow) have some specific permission (OAuth2 scope).

FastAPI provides that part, and that is integrated into OpenAPI, the docs UI, etc.

For example, OAuth2 scopes are what Google, Facebook, and GitHub use. When you "login to service X with app Y" (login with Google, Facebook, GitHub, etc), you give the app X some permissions/scopes.

https://fastapi.tiangolo.com/advanced/security/oauth2-scopes/

[imadmoussa1]

@tiangolo Thank you. I will start implementing those 2 parts.
I already started implementing the OAuth2, I will add the scope and permission to it.

[tiangolo]

Cool! May we close this issue now @imadmoussa1 ?

[github-actions]

Assuming the original issue was solved, it will be automatically closed now. But feel free to add more comments or create new issues.