Attribute connectors
It is possible to have a setup where a policy decision cannot be reached solely on the information provided in the request. Access Decision Service can use attribute connectors to connect to external sources, where the information required may be found. For example, certain attributes of a policy may need to get their values from a database or an LDAP directory.
An attribute connector configuration contains information about the type of attribute source (for example, LDAP, SQL), the XACML attributes it provides, and how to obtain them.
The attribute connector configuration is part of the authorization domain configuration. If an attribute connector configuration exists in the authorization domain configuration, that attribute connector must be available to ADS at start-up. The attribute connector itself is then used at runtime during policy evaluation.
Standard attribute connectors
There are no default attribute connectors included with ADS. Instead, attribute connectors for connection to SQL and LDAP data sources must be downloaded and installed separately. Axiomatics currently provides three standard attribute connectors:
- LDAP Attribute Connector
- SQL Attribute Connector
- Table Attribute Connector
The LDAP Attribute Connector is used for connection to LDAP data sources. The SQL Attribute Connector and the Table Attribute Connector are both used for connections to SQL data sources. Contact Axiomatics Customer Support for information on latest versions and available downloads.
The standard attribute connectors are managed in slightly different ways, depending on whether ADS is run in a Docker container or from the command line.
The standard attribute connectors are developed, maintained, and released independently of releases of ADS. New and updated versions may be released and made available for download at any time.
Custom attribute connectors
It is possible to create custom attribute connectors, which may be used to fetch attributes that are not supported by the standard attribute connectors.
Custom attribute connectors, or Attribute Finders, are built for the Java ServiceLoader.
When a custom Attribute Finder has been set up in ADS, the same Attribute Finder package must be made available to ASM as an attribute connector so that it shows up in the list of available Attribute Connector types that can be chosen in the ASM GUI.
Adding or updating attribute connectors
If an attribute connector configuration exists in the authorization domain configuration, ADS must be started with the jar file for that attribute connector in the classpath. The attribute connector itself is then used at runtime during policy evaluation.
There are no default attribute connectors included with the ADS jar file download. Instead, standard attribute connectors (see above) must be downloaded and installed separately.
Contact Axiomatics Customer Support for information on latest versions and available downloads.
- Download and extract to a suitable location the attribute connectors needed for use.
After that, ADS needs to know how to locate them and all their dependencies, which is done by adding this information to the classpath. The process is the same for both adding and updating attribute connectors, standard or custom.
ADS can work with different attribute connectors for different sources concurrently. Jar files on the classpath are separated with a semi-colon (';') on Windows, and with a colon (':') on other platforms.
On Windows:
java -cp access-decision-service-<version>.jar;<path_to_file>/sql-attribute-connector-<version>.jar;<path_to_file>/Dependency1.jar;<path_to_file>/Dependency2.jar com.axiomatics.ads.App server <path\to\>deployment.yaml
On Linux:
java -cp access-decision-service-<version>.jar:<path_to_file>/sql-attribute-connector-<version>.jar:<path_to_file>/Dependency1.jar:<path_to_file>/Dependency2.jar com.axiomatics.ads.App server <path_to_file>/deployment.yaml
Downloading an attribute connector
The Attribute Connector is downloaded via AWS CLI. If you have not already done so, install AWS CLI according to the instructions here.
The Attribute Connector is downloaded as a jar file.
To have access to Axiomatics downloads, you need to configure the AWS CLI account with the
aws configurecommand, as explained here. This step requires the Access key ID and Secret access key, provided to you by Axiomatics.Choose which version of the Attribute Connector you want to download. Copy that command and run it in the terminal. For example:
- Table Attribute Connector:
aws s3api get-object --bucket axiomatics-customer-artifacts --key releases/com/axiomatics/attribute-connectors/table/table-attribute-connector/x.x.x/table-attribute-connector-x.x.x.jar table-attribute-connector-x.x.x.jar- LDAP Attribute Connector:
aws s3api get-object --bucket axiomatics-customer-artifacts --key releases/com/axiomatics/attribute-connectors/ldap/ldap-attribute-connector/x.x.x/ldap-attribute-connector-x.x.x.jar ldap-attribute-connector-x.x.x.jar- SQL Attribute Connector:
aws s3api get-object --bucket axiomatics-customer-artifacts --key releases/com/axiomatics/attribute-connectors/sql/sql-attribute-connector/x.x.x/sql-attribute-connector-x.x.x.jar sql-attribute-connector-x.x.x.jar
In the examples above x.x.x refers to the respective version of each Attribute Connector.
More information
Refer to the documentation for Axiomatics Services Manager for more information about attribute connectors.