Auth Playground — RBAC, ABAC & PBAC in .NET 10

A production-style learning repository that teaches Role-Based (RBAC), Attribute-Based (ABAC), and Policy-Based (PBAC) access control in ASP.NET Core, with a real OIDC/OAuth2 identity service, protected APIs, Swagger testing, Docker Compose, and comprehensive documentation.

What You'll Learn

• RBAC: Role-based endpoint protection ([Authorize(Roles = "Admin")])
• ABAC: Attribute-based resource access (department, region, tenant, clearance level)
• PBAC: Policy-based composite rules that wrap RBAC + ABAC
• OAuth2/OIDC flows: Authorization Code + PKCE, Client Credentials
• Resource-based authorization: Imperative checks with IAuthorizationService
• Custom authorization handlers: The core of fine-grained access control in .NET
• Multi-tenant isolation: Tenant-based ABAC filtering
• Service-to-service auth: Client Credentials with scope-based policies

Quick Start

docker compose up --build

Test Accounts

Architecture

┌─────────────┐     ┌──────────────────┐     ┌────────────┐
│ Swagger UI  │────▶│  Identity Service │     │ PostgreSQL │
│ (PKCE flow) │     │  (OpenIddict)     │────▶│            │
└─────┬───────┘     └──────────────────┘     └────────────┘
      │ Bearer Token         ▲
      ▼                      │ Token Validation
┌─────────────┐              │
│ API Service │──────────────┘
│ (RBAC/ABAC/ │
│  PBAC)      │────▶ PostgreSQL
└─────────────┘

Project Structure

Authorization Models Demonstrated

RBAC (Role-Based)

// Only Admin can manage policies
.RequireAuthorization(AppPolicies.RequireAdmin)

ABAC (Attribute-Based)

// Handler checks: user.department == document.department
public class SameDepartmentHandler : AuthorizationHandler<SameDepartmentRequirement, Document>

PBAC (Policy-Based, composing RBAC + ABAC)

// "CanApproveDocument" = Manager role + same department + pending status
.AddPolicy("CanApproveDocument", p => p.AddRequirements(new DocumentApprovalRequirement()))

Documentation

Detailed docs with Mermaid diagrams in /docs:

Tech Stack

• .NET 10, ASP.NET Core Minimal APIs
• OpenIddict (OIDC/OAuth2)
• ASP.NET Core Identity
• Entity Framework Core + PostgreSQL
• Swagger/OpenAPI (Swashbuckle)
• xUnit + Moq (testing)
• Docker Compose

License

MIT — use freely for learning and reference.