Comments (2)
Initialization
The PDP is initialized with attribute providers based on the 'attributeProvider' elements in the PDP (XML) configuration, if there is any. (You can also do it programmatically if you really need to, but it is rather for more advanced users.) As the XML schema says, there may be zero, one or many of these. Indeed, using Attribute Providers is not mandatory. They are unnecessary if you expect all attributes to be provided in the requests (from PEP), or computed directly by the PDP like the current date/time as I mention in the next paragraph.
There is a special case for the standard current date/time attributes (ยง10.2.5 of XACML spec):
- If and only if the PDP configuration has the
standardEnvAttributeSource
set toPDP_ONLY
, the PDP will always provide the current date/time attributes on its own (internally) for each request. - If set to
REQUEST_ELSE_PDP
, same thing but only if the attribute is not present in the request. - Else the PDP never provides it on its own.
Attribute providers implement Java interface CloseableNamedAttributeProvider; and during initialization, the PDP constructor calls method getProvidedAttributes()
(defined by superinterface NamedAttributeProvider
) on each one, in order to know which attributes it supports / can provide. Therefore, at the end of initialization, the PDP knows which attribute provider to call depending on the attribute it needs. (This avoids looping over all of them every time until it finds the good one.)
Request evaluation
After the PDP is initialized, it is ready to handle xacml requests.
For each request, the PDP initializes a request context (represented by Java class EvaluationContext) and puts in it all request attributes, and the current date/time attributes if necessary, depending on the standardEnvAttributeSource
configuration parameter mentioned previously, and whether these attributes are in the request already. Then begins the evaluation of the request against the policy (XACML Policy or PolicySet). During the evaluation, the PDP will query Attribute Providers - calling their method get (...) in the following cases:
- The PDP comes upon an
AttributeDesignator
and cannot find a matching attribute in the current request context. - The PDP comes upon an
AttributeSelector
with aContextSelectorId
and cannot find a matching attribute in the current request context. - An attribute provider is being called but requires/depends on another attribute X to proceed, and X cannot be found in the current request context. This is the edge case. For example, the PDP is calling an Attribute Provider to get the subject role attribute. But this Attribute Provider needs the subject ID attribute in order to find the subject role. However, there is no subject ID in the request context (again, this is an edge case just for example). Therefore it calls another Attribute Provider that can provide the subject ID based on the MAC address attribute (assuming there is a one-to-one relationship between the two), and this time the MAC address happens to be in the request context. All's well that ends well.
In all cases, the new attribute (category, ID...) is added to the request context with the result returned by AttributeProvider#get(...) as value, so that it can be retrieved from there directly if needed again.
from core.
Thank you for the excellent answer! Now, I can go further with my design of the system. You could use parts of your answer to enrich your wiki article of this github repo.
from core.
Related Issues (20)
- Test failed on authzforce-ce-core-pdp-testutils module version 17.0.0 HOT 1
- Compilation failure due to XacmlJsonUtils.canonicalizeResponse method signature issue HOT 1
- Use latest parent version to benefit from dependency-check-maven fix
- Implementation help HOT 8
- org.ow2.authzforce.core.pdp.testutil.ext.xsd MongoDBPolicyProvider ServerHost Pattern HOT 2
- Question about Evaluating Requests in XACML/JSON format HOT 4
- Support XACML <VariableRef> in <Match> via AttributeDesignator workaround
- Refactor BasePdpEngine - Move the StandardEnvironmentAttribute* code to dedicated AttributeProvider
- Mutli requests in the use of CLI HOT 2
- Issue in building the project using cmd HOT 3
- Enable PDP extensions (e.g. Functions) to return an error about invalid attribute values in form of XACML <StatusDetail> / <MissingAttributeDetail>s HOT 3
- org.ow2.authzforce.domains.xacmlJsonSchemaRelativePath has no effect HOT 1
- clientRequestErrorVerbosityLevel > 0 throws startup exception HOT 1
- ConditionEvaluators.java -> throwing exception when conditional evaluates to false.
- The permit-unless-deny in policySet and policy produce an error HOT 3
- Is it possible to bound a jaxb scope for authzforce HOT 3
- Timeline for migrating the javax namespace HOT 2
- Migrate to Java 17+
- Deny-overrides rule combining algorithm - Missing obligations in case of multiple Permit Rules and no Deny Rule HOT 1
- Comparison by issuer even if it is not defined in AttributeDesignator HOT 12
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ๐๐๐
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google โค๏ธ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from core.