ASM and ADS integration

You can configure Access Decision Service (ADS) to retrieve its authorization domain from Axiomatics Services Manager (ASM) by accessing the Domain management API of ASM, as described in the Domain management APIOpens in a new tab section of the ASM documentation.

In order for ADS to communicate with ASM, you should configure Keycloak which is used by ASM for authentication and access management purposes.

Integration procedure

The following steps are required for a successful integration between ADS and ASM:

1. Configure an authorization domain in an ASM project.

   For more information on how to manage authorization domain configurations, refer to the Domain managementOpens in a new tab section of the ASM documentation.

2. Set up the Keycloak client to provide authentication access to ADS, following the instructions provided in the Configure Keycloak for ADSOpens in a new tab section of the ASM documentation.

3. Update the ADS deployment YAML file by configuring the following properties:

   • domain

     note

     The space character (" ") in a domain name should be replaced with its URL-encoded representation in the domain property, which is %20. This ensures that the URL is correctly interpreted by web browsers and servers.

     For example, Project 1 should be replaced by Project%201 in the URL, as shown below:

     domain: https://<hostanme/adm/api/namespaces/Project%201/names/mydomain/domain

   • authHttpClientConfiguration

   • domainRefreshInterval

You can configure the domain property of the deployment.yaml file in order to retrieve the domain using one of the two ADM’s endpoints as displayed in the examples below:

• ADS using RetrieveDomainByName endpoint

  The RetrieveDomainByName endpoint is used to retrieve a specific domain within a namespace.

  Example:

  domain: https://<hostname>/adm/api/namespaces/test/names/testA/domain

  In this example, test is the namespace and testA is the domain name.

• ADS using RetrieveDomainByID endpoint

  The RetrieveDomainByID endpoint is used to retrieve a specific domain instance by its ID.

  Example:

  domain: http://<hostname>/adm/api/domains/e8a9e7d6-8fc6-4706-ac7d-a74eff74c58c

  In this example, e8a9e7d6-8fc6-4706-ac7d-a74eff74c58c is the domain-id.

  Deployment configuration sample

  This is a customized sample of an ADS deployment YAML file that supports the ADS-ASM integration configuration:

  ## Access Decision Service configuration for integration with Axiomatics Services Manager
  #### Path to license file
  license: file:<path_to_file>/axiomatics_PDP.license
  #### Path to domain configuration file
  
  domain: https://<hostname>/adm/api/namespaces/Test-Project/names/Test-Domain/domain     
      #### Endpoint from which the client contacts the domain manage. The domain is retrieved from ASM
      #### Test-Project = namespace
      #### Test-Domain = domain name
  authHttpClientConfiguration:        #### Authorization server configuration
    clientId: ads                     #### the ADS instance name
    clientSecret: <secret>            #### the generated secret for the specific client   
    tokenUri: https://<hostname>/auth/realms/asm/protocol/openid-connect/token 
    ####URI to the authorization server
    timeout: 30 seconds               #### The maximum idle time for a connection
    
  domainRefreshInterval: 5 seconds    #### This property configures ADS to update the domain configuration during runtime by polling its source at regular intervals.