Ory keto

忘是亡心i 2023-02-17 03:39 33阅读 0赞

# 权限服务器keto #

> keto介绍  
> ORY Keto是一种权限服务器，它实现最佳实践访问控制机制：

*  今天可用：具有精确，全局和正则表达式匹配策略的ORY风格的访问控制策略
 *  即将推出：
 *  访问控制列表
 *  基于角色的访问控制
 *  具有上下文的基于角色的访问控制（Google / Kubernetes风格）
 *  Amazon Web Services身份和访问管理策略（AWS IAM策略）
 *  每种机制都由在开放策略代理之上实现的决策引擎提供动力,并提供定义明确的管理和授权端点

## 1 代码下载 ##

[keto源码地址下载][keto]

[官方文档简单说明][Link 1]

> 解压说明  
> **把下载的源码解压后放在本地`%GOPATH%/src`目录下**

**注:GOPATH为项目的运行时的工作空间位置,GOPATH其中包含三个子目录如下**

*  src 目录包含Go的源文件，它们被组织成包（每个目录都对应一个包）
 *  pkg 目录包含包对象
 *  bin 目录包含可执行命令

![\[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-D5g6mf68-1591890034559)(/img/goImage/keto1.png)\]][img-D5g6mf68-1591890034559_img_goImage_keto1.png]

## 2 关键词介绍 ##

### 2.1 RBAC ###

> RBAC介绍  
> RBAC是基于角色的访问控制（`Role-Based Access Control` ）在 RBAC 中，权限与角色相关联，用户通过成为适当角色的成员而得到这些角色的权限。这就极大地简化了权限的管理。这样管理都是层级相互依赖的，权限赋予给角色，而把角色又赋予用户，这样的权限设计很清楚，管理起来很方便。  
> 。RBAC 认为授权实际上是`Who` 、`What` 、`How` 三元组之间的关系，也就是`Who` 对`What` 进行`How` 的操作，也就是“主体”对“客体”的操作。  
> 然后 RBAC 又分为`RBAC0、RBAC1、RBAC2、RBAC3` ，如果你不知道他们有什么区别，你可以百度百科：[百度百科-RBAC][-RBAC] ,也可以看看我的介绍。

*  `Who`：是权限的拥有者或主体（如：User，Role）。
 *  `What`：是操作或对象（operation，object）。
 *  `How`：具体的权限（Privilege,正向授权与负向授权）。

### 2.1 ABAC ###

> ABAC介绍  
> ABAC（Attribute Base Access Control） 基于属性的权限控制，不同于常见的将用户通过某种方式关联到权限的方式，ABAC则是通过动态计算一个或一组属性来是否满足某种条件来进行授权判断（可以编写简单的逻辑）。属性通常来说分为四类：用户属性（如用户年龄），环境属性（如当前时间），操作属性（如读取）和对象属性（如一篇文章，又称资源属性），所以理论上能够实现非常灵活的权限控制，几乎能满足所有类型的需求。  
> 访问控制列表(\*\*ACL \*\*)是一种基于包过滤的[访问控制技术][Link 2]，它可以根据设定的条件对接口上的数据包进行过滤，允许其通过或丢弃。访问控制列表被广泛地应用于[路由器][Link 3]和三层[交换机][Link 4]，借助于访问控制列表，可以有效地控制用户对网络的访问，从而最大程度地保障网络安全。

### 2.3 采坑bug修改 ###

![\[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-AFOyCvyD-1591890034564)(/img/goImage/bug1.png)\]][img-AFOyCvyD-1591890034564_img_goImage_bug1.png]

将url.go 中的  
![\[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-9tJtz5Rl-1591890034568)(/img/goImage/bug1xxiu.png)\]][img-9tJtz5Rl-1591890034568_img_goImage_bug1xxiu.png]

修改为  
![\[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-xCqOfDvW-1591890034572)(/img/goImage/bug1xiu.png)\]][img-xCqOfDvW-1591890034572_img_goImage_bug1xiu.png]

这个问题存在是由于应用源码对字符串的解析问题，可以不写端口，采用默认的端口

## 3 项目运行 ##

> 官方代码下载后编译成keto.exe执行，直接执行指挥出现提示页面

### 3.1 代码示例 ###

dsn: mysql://root:minda123@tcp(127.0.0.1)/keto?parseTime=true&multiStatements=true 
    # 这里如果用默认端口就不要加端口号：3306
    
    secrets:
      system:
        - admin1
        - admin2
        - admin3

>keto.exe --config F:/awesomeProject/bin/config.yaml migrate sql -e
          
    time="2019-12-25T16:27:28+08:00" level=info msg="Connecting with mysql://*:*@tcp(127.0.0.1)/keto?multiStatements=true"
    time="2019-12-25T16:27:28+08:00" level=info msg="Connected to SQL!"
    time="2019-12-25T16:27:28+08:00" level=info msg="Applying storage SQL migrations..."
    time="2019-12-25T16:27:28+08:00" level=info msg="Successfully applied SQL migrations" applied_migrations=1 migration=name
    time="2019-12-25T16:27:28+08:00" level=info msg="Done applying storage SQL migrations"

### 3.2 启动服务 ###

serve --config F:/awesomeProject/bin/config.yaml

### 3.3 项目API ###

**swagger安装教程**

> 进入项目根目录，启动swagger服务

swagger serve -F=swagger F:\awesomeProject\src\github.com\ory\keto\docs\api.swagger.json

**运行成功后会提示服务运行在的地址，点击进入即可看到如下页面：**

### 3.4 主要是要用的访问策略 ###

#### ACL： ####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NDkzNTU2_size_16_color_FFFFFF_t_70]  
访问控制列表

<table> 
 <thead> 
  <tr> 
   <th></th> 
   <th>blog_post.create</th> 
   <th>blog_post.delete</th> 
   <th>blog_post.modify</th> 
   <th>blog_post.read</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>Alice</td> 
   <td>yes</td> 
   <td>yes</td> 
   <td>yes</td> 
   <td>yes</td> 
  </tr> 
  <tr> 
   <td>Bob</td> 
   <td>no</td> 
   <td>no</td> 
   <td>no</td> 
   <td>yes</td> 
  </tr> 
  <tr> 
   <td>Peter</td> 
   <td>yes</td> 
   <td>no</td> 
   <td>yes</td> 
   <td>yes</td> 
  </tr> 
 </tbody> 
</table>

#### RBAC： ####

## 4 ORY Access Control Policies ##

### 4.1 策略准备 ###

> put请求：http://127.0.0.1:4444//engines/acp/ory/glob/policies

{ 
      "subjects": ["alice"],
      "resources": ["blog_posts:my-first-blog-post"],
      "actions": ["delete"],
      "effect": "allow"
    }

同样：

{ 
      "subjects": ["alice", "bob"],
      "resources": [
        "blog_posts:my-first-blog-post",
        "blog_posts:2",
        "blog_posts:3"
      ],
      "actions": ["delete", "create", "read", "modify"],
      "effect": "allow"
    }

会在数据库生成新的记录

{ 
      "subjects": ["peter"],
      "resources": [
        "blog_posts:my-first-blog-post",
        "blog_posts:2",
        "blog_posts:3"
      ],
      "actions": ["delete", "create", "read", "modify"],
      "effect": "deny"
    }

The `:` is a delimiter in ORY Access Control Policies. Other supported syntax  
is:

**single symbol wildcard:** `?at` matches `cat` and `bat` but not `at`  
**wildcard:** `foo:*:bar` matches `foo:baz:bar` and `foo:zab:bar` but not  
`foo:bar` nor `foo:baz:baz:bar`  
**super wildcard:** `foo:**:bar` matches `foo:baz:baz:bar`, `foo:baz:bar`, and  
`foo:bar`, but not `foobar` or `foo:baz`  
**character list:** `[cb]at` matches `cat` and `bat` but not `mat` nor `at`.  
**negated character list:** `[!cb]at` matches `tat` and `mat` but not `cat`  
nor `bat`.  
**ranged character list:** `[a-c]at` `cat` and `bat` but not `mat` nor `at`.  
**negated ranged character list:** `[!a-c]at` matches `mat` and `tat` but not  
`cat` nor `bat`.  
**alternatives list:** `{cat,bat,[mt]at}` matches `cat`, `bat`, `mat`, `tat`  
and nothing else.  
**backslash:** `foo\\bar` matches `foo\bar` and nothing else. `foo\bar`  
matches `foobar` and nothing else. `foo\*bar` matches `foo*bar` and nothing  
else. Please note that when using JSON you need to double escape backslashes:  
`foo\\bar` becomes `{"...": "foo\\\\bar"}`.

The pattern syntax is:

pattern:
    
          {  term }
    
      term:
    
          *         matches any sequence of non-separator characters
    
          **        matches any sequence of characters
    
          ?         matches any single non-separator character
    
          [ [ ! ] {  character-range } ]
    
                      character class (must be non-empty)
    
          {  pattern-list }
    
                      pattern alternatives
    
          c           matches character c (c != *, **, ?, \, [, { , })
    
          \ c       matches character c
    
      character-range:
    
          c           matches character c (c != \\, -, ])
    
          \ c       matches character c
    
          lo - hi   matches character c for lo <= c <= hi
    
      pattern-list:
    
          pattern {  , pattern }
    
                      comma-separated (without spaces) pattern

### 4.2 json实例 ###

{ 
      "description": "One policy to rule them all.",
      "subjects": ["users:maria:*"],
      "actions": ["delete", "create", "update","modify","get","read"],
      "effect": "allow",
      "resources": ["resources:articles:<.*>"],
      "conditions": { 
        "someKeyName": { 
          "type": "StringMatchCondition",
          "options": { 
            "matches": "foo.+"
          }
        },
        "someKey": { 
          "type": "StringPairsEqualCondition",
          "options": { }
        }, 
        "myKey": { 
          "type": "StringEqualCondition",
          "options": { 
            "equals": "expected-value"
          }
        },      
        "remoteIPAddress": { 
          "type": "CIDRCondition",
          "options": { 
            "cidr": "192.168.0.0/16"
          }
        },
        "this-key-will-be-matched-with-the-context": { 
          "type": "SomeConditionType",
          "options": { 
            "some": "configuration options set by the condition type"
          }
        }
      },
       "context": { 
        "someKey": [["foo", "foo"], ["bar", "bar"]]
      }
    }

### 4.3 主要请求及其说明 ###

#### 参数说明 ####

#### 响应参数说明 ####

<table> 
 <thead> 
  <tr> 
   <th>Name</th> 
   <th>Type</th> 
   <th>Required</th> 
   <th>Restrictions</th> 
   <th>Description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>code</td> 
   <td>integer(int64)</td> 
   <td>false</td> 
   <td>none</td> 
   <td>none</td> 
  </tr> 
  <tr> 
   <td>details</td> 
   <td>[object]</td> 
   <td>false</td> 
   <td>none</td> 
   <td>none</td> 
  </tr> 
  <tr> 
   <td>additionalProperties</td> 
   <td>object</td> 
   <td>false</td> 
   <td>none</td> 
   <td>none</td> 
  </tr> 
  <tr> 
   <td>message</td> 
   <td>string</td> 
   <td>false</td> 
   <td>none</td> 
   <td>none</td> 
  </tr> 
  <tr> 
   <td>reason</td> 
   <td>string</td> 
   <td>false</td> 
   <td>none</td> 
   <td>none</td> 
  </tr> 
  <tr> 
   <td>request</td> 
   <td>string</td> 
   <td>false</td> 
   <td>none</td> 
   <td>none</td> 
  </tr> 
  <tr> 
   <td>status</td> 
   <td>string</td> 
   <td>false</td> 
   <td>none</td> 
   <td>none</td> 
  </tr> 
 </tbody> 
</table>

#### 请求参数说明 ####

<table> 
 <thead> 
  <tr> 
   <th>Parameter</th> 
   <th>In</th> 
   <th align="left">Type</th> 
   <th align="left">Required</th> 
   <th>Description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>flavor</td> 
   <td>path</td> 
   <td align="left">string</td> 
   <td align="left">true</td> 
   <td>The ORY Access Control Policy flavor. Can be “regex”, “glob”, and “exact”.</td> 
  </tr> 
 </tbody> 
</table>

### 4.4 检查请求是否允许通过 ###

请求头

POST /engines/acp/ory/{flavor}/allowed HTTP/1.1
    
    Content-Type: application/json
    
    Accept: application/json

body

{
      "action": "string",
      "context": {
        "property1": {},
        "property2": {}
      },
      "resource": "string",
      "subject": "string"
    }

### 4.5 参数列表 ###

OryAccessControlPolicyAllowedInput\*

<table> 
 <thead> 
  <tr> 
   <th>Name</th> 
   <th>Type</th> 
   <th>Required</th> 
   <th>Restrictions</th> 
   <th>Description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>action</td> 
   <td>string</td> 
   <td>false</td> 
   <td>none</td> 
   <td>Action is the action that is requested on the resource.</td> 
  </tr> 
  <tr> 
   <td>context</td> 
   <td>object</td> 
   <td>false</td> 
   <td>none</td> 
   <td>Context is the request’s environmental context.</td> 
  </tr> 
  <tr> 
   <td><strong>additionalProperties</strong></td> 
   <td>object</td> 
   <td>false</td> 
   <td>none</td> 
   <td>none</td> 
  </tr> 
  <tr> 
   <td>resource</td> 
   <td>string</td> 
   <td>false</td> 
   <td>none</td> 
   <td>Resource is the resource that access is requested to.</td> 
  </tr> 
  <tr> 
   <td>subject</td> 
   <td>string</td> 
   <td>false</td> 
   <td>none</td> 
   <td>Subject is the subject that is requesting access.</td> 
  </tr> 
 </tbody> 
</table>

response

`{"allowed":"true"}` or `{"allowed":"false"}`

## 5 访问控制策略操作 ##

### 5.1 获取访问控制策略集合 ###

GET /engines/acp/ory/{flavor}/policies HTTP/1.1
    Accept: application/json

参数列表

<table> 
 <thead> 
  <tr> 
   <th>Parameter</th> 
   <th>In</th> 
   <th>Type</th> 
   <th>Required</th> 
   <th>Description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>flavor</td> 
   <td>path</td> 
   <td>string</td> 
   <td>true</td> 
   <td>The ORY Access Control Policy flavor. Can be “regex”, “glob”, and “exact”</td> 
  </tr> 
  <tr> 
   <td>limit</td> 
   <td>query</td> 
   <td>integer(int64)</td> 
   <td>false</td> 
   <td>The maximum amount of policies returned.</td> 
  </tr> 
  <tr> 
   <td>offset</td> 
   <td>query</td> 
   <td>integer(int64)</td> 
   <td>false</td> 
   <td>The offset from where to start looking.</td> 
  </tr> 
  <tr> 
   <td>subject</td> 
   <td>query</td> 
   <td>string</td> 
   <td>false</td> 
   <td>The subject for whom the policies are to be listed.</td> 
  </tr> 
  <tr> 
   <td>resource</td> 
   <td>query</td> 
   <td>string</td> 
   <td>false</td> 
   <td>The resource for which the policies are to be listed.</td> 
  </tr> 
  <tr> 
   <td>action</td> 
   <td>query</td> 
   <td>string</td> 
   <td>false</td> 
   <td>The action for which policies are to be listed.</td> 
  </tr> 
 </tbody> 
</table>

### 5.2 更新访问控制策略 ###

PUT /engines/acp/ory/{ flavor}/policies HTTP/1.1
    Content-Type: application/json
    Accept: application/json

参数列表

<table> 
 <thead> 
  <tr> 
   <th>Parameter</th> 
   <th>Type</th> 
   <th>Required</th> 
   <th><strong>Restrictions</strong></th> 
   <th>Description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>actions</td> 
   <td>[string]</td> 
   <td>false</td> 
   <td>none</td> 
   <td>Actions is an array representing all the actions this ORY Access Policy applies to.</td> 
  </tr> 
  <tr> 
   <td>conditions</td> 
   <td>object</td> 
   <td>false</td> 
   <td>none</td> 
   <td>Conditions represents a keyed object of conditions under which this ORY Access Policy is active.</td> 
  </tr> 
  <tr> 
   <td><strong>additionalProperties</strong></td> 
   <td>object</td> 
   <td>false</td> 
   <td>none</td> 
   <td>none</td> 
  </tr> 
  <tr> 
   <td>description</td> 
   <td>string</td> 
   <td>false</td> 
   <td>none</td> 
   <td>Description is an optional, human-readable description.</td> 
  </tr> 
  <tr> 
   <td>effect</td> 
   <td>string</td> 
   <td>false</td> 
   <td>none</td> 
   <td>Effect is the effect of this ORY Access Policy. It can be “allow” or “deny”.</td> 
  </tr> 
  <tr> 
   <td>id</td> 
   <td>string</td> 
   <td>false</td> 
   <td>none</td> 
   <td>访问策略的唯一标识，用来查询，更新和删除</td> 
  </tr> 
  <tr> 
   <td>resources</td> 
   <td>[string]</td> 
   <td>false</td> 
   <td>none</td> 
   <td>Resources is an array representing all the resources this ORY Access Policy applies to.</td> 
  </tr> 
  <tr> 
   <td>subjects</td> 
   <td>[string]</td> 
   <td>false</td> 
   <td>none</td> 
   <td>Subjects is an array representing all the subjects this ORY Access Policy applies to.</td> 
  </tr> 
 </tbody> 
</table>

### 5.3 查询具体的策略 ###

GET /engines/acp/ory/{flavor}/policies/{id} HTTP/1.1
    Accept: application/json

### 5.4 删除访问控制策略 ###

DELETE /engines/acp/ory/{flavor}/policies/{id} HTTP/1.1
    Accept: application/json

## 6 访问控制策略角色操作 ##

### 6.1 查询寻访问控制角色集合 ###

GET /engines/acp/ory/{flavor}/roles HTTP/1.1
    Accept: application/json

参数说明：

<table> 
 <thead> 
  <tr> 
   <th>Parameter</th> 
   <th>In</th> 
   <th>Type</th> 
   <th>Required</th> 
   <th>Description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>flavor</td> 
   <td>path</td> 
   <td>string</td> 
   <td>true</td> 
   <td>The ORY Access Control Policy flavor. Can be “regex”, “glob”, and “exact”</td> 
  </tr> 
  <tr> 
   <td>limit</td> 
   <td>query</td> 
   <td>integer(int64)</td> 
   <td>false</td> 
   <td>The maximum amount of policies returned.</td> 
  </tr> 
  <tr> 
   <td>offset</td> 
   <td>query</td> 
   <td>integer(int64)</td> 
   <td>false</td> 
   <td>The offset from where to start looking.</td> 
  </tr> 
  <tr> 
   <td>member</td> 
   <td>query</td> 
   <td>string</td> 
   <td>false</td> 
   <td>The member for which the roles are to be listed.</td> 
  </tr> 
 </tbody> 
</table>

### 6.2 添加访问控制的角色 ###

PUT /engines/acp/ory/{flavor}/roles HTTP/1.1
    Content-Type: application/json
    Accept: application/json

例子：

{
      "id": "string",
      "members": ["string"]
    }

参数列表

<table> 
 <thead> 
  <tr> 
   <th>Parameter</th> 
   <th>Type</th> 
   <th>Required</th> 
   <th>Description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>id</td> 
   <td>string</td> 
   <td>false</td> 
   <td>ID is the role’s unique id.</td> 
  </tr> 
  <tr> 
   <td>members</td> 
   <td>[string]</td> 
   <td>false</td> 
   <td>Members is who belongs to the role.</td> 
  </tr> 
 </tbody> 
</table>

### 6.3 获取访问控制角色信息 ###

GET /engines/acp/ory/{flavor}/roles/{id} HTTP/1.1
    Accept: application/json

### 6.4 删除访问控制角色信息 ###

DELETE  /engines/acp/ory/{flavor}/roles/{id} HTTP/1.1
    Accept: application/json

### 6.5 为角色添加用户 ###

PUT /engines/acp/ory/{flavor}/roles/{id}/members HTTP/1.1 Content-Type: application/json Accept: application/json
    
    请求体：
    {
      "members": ["string"]
    }

### 6.6从角色中删除某个用户成员 ###

DELETE /engines/acp/ory/{flavor}/roles/{id}/members/{member} HTTP/1.1 Accept: application/json

## 7 健康检查 ##

### 7.1 检查存活状态 ###

GET /health/alive HTTP/1.1
    Accept: application/json

结果：（官方说明总是ok）

{  "status": "ok" }

### 7.2 检查准备就绪 ###

GET /health/ready HTTP/1.1
    Accept: application/json

### 7.3 获取当前版本 ###

GET /version HTTP/1.1 
    Accept: application/json

## 8 测试样例 ##

put   http://127.0.0.1:4444/engines/acp/ory/glob/policies
    
    {
      "actions": ["get","create","modify","delete"],
      "conditions": {
        "optionAccess": {
        	"type": "CIDRCondition",
        	"options": {
            "cidr": "192.168.0.0/16"
          }
        }
      },
      "description": "test q",
      "effect": "allow",
      "id": "string",
      "resources": [ 
      	"blog_posts:my-first-blog-post",
        "blog_posts:2",
        "blog_posts:3"],
      "subjects": ["admin","admin1","admin2"]
    }

ation/json

## 8 测试样例

put http://127.0.0.1:4444/engines/acp/ory/glob/policies

\{  
“actions”: \[“get”,“create”,“modify”,“delete”\],  
“conditions”: \{  
“optionAccess”: \{  
“type”: “CIDRCondition”,  
“options”: \{  
“cidr”: “192.168.0.0/16”  
\}  
\}  
\},  
“description”: “test q”,  
“effect”: “allow”,  
“id”: “string”,  
“resources”: \[  
“blog\_posts:my-first-blog-post”,  
“blog\_posts:2”,  
“blog\_posts:3”\],  
“subjects”: \[“admin”,“admin1”,“admin2”\]  
\}

[keto]: https://github.com/ory/keto
[Link 1]: https://www.ory.sh/?utm_source=github&utm_medium=banner&utm_campaign=keto
[img-D5g6mf68-1591890034559_img_goImage_keto1.png]: https://img-blog.csdnimg.cn/20200611233906795.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NDkzNTU2,size_16,color_FFFFFF,t_70
[-RBAC]: http://baike.baidu.com/link?url=Tg3nxejvD2QVLLkjKa_4XaQoOWSPAVpR1FgHAG_gANcamtN2cYIm1r1irNw9VZ816FBrMEvdoYqwzixqdHd5e_
[Link 2]: https://baike.baidu.com/item/%E8%AE%BF%E9%97%AE%E6%8E%A7%E5%88%B6%E6%8A%80%E6%9C%AF/5652430
[Link 3]: https://baike.baidu.com/item/%E8%B7%AF%E7%94%B1%E5%99%A8/108294
[Link 4]: https://baike.baidu.com/item/%E4%BA%A4%E6%8D%A2%E6%9C%BA/103532
[img-AFOyCvyD-1591890034564_img_goImage_bug1.png]: https://img-blog.csdnimg.cn/20200611233954247.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NDkzNTU2,size_16,color_FFFFFF,t_70
[img-9tJtz5Rl-1591890034568_img_goImage_bug1xxiu.png]: https://img-blog.csdnimg.cn/20200611234003965.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NDkzNTU2,size_16,color_FFFFFF,t_70
[img-xCqOfDvW-1591890034572_img_goImage_bug1xiu.png]: https://img-blog.csdnimg.cn/20200611234010981.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NDkzNTU2,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NDkzNTU2_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200611234103872.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NDkzNTU2,size_16,color_FFFFFF,t_70

Ory keto

发表评论取消回复

还没有评论，来说两句吧...

相关阅读

相关 Keto 实现 ABAC 权限

相关 Ory keto

相关 ORY Hydra项目详解