Attribute connectors
What are attribute connectors?
Attribute connectors are components that fetch attribute values from external systems at the moment ADS evaluates an access request. They act as Policy Information Points (PIPs) in the XACML reference architecture.
Policies frequently depend on attributes that are not included in the incoming request. For example, a policy might require the user's department, a resource's security classification, or the user's current group memberships, none of which the calling application necessarily sends. Attribute connectors bridge this gap: they reach out to the authoritative source (an LDAP directory, a database, an HTTP service) and retrieve the values ADS needs before it renders a decision.
You configure each connector inside the authorization domain. The domain definition specifies which connector type to use, which attributes the connector provides, and how to connect to the data source.
Connector types
ADS includes the following standard connector types.
| Type | Data source | When to use |
|---|---|---|
| LDAP | LDAP or Active Directory | Fetch user attributes such as department, group membership, or organizational unit from a directory service. |
| SQL | Any JDBC-compatible relational database | Fetch attributes stored in database tables. Use SQL when you need arbitrary queries. |
| Table | Any JDBC-compatible relational database | Fetch attributes directly from named columns in a database table. A simpler alternative to SQL when no custom query logic is needed. |
| HTTP | Any REST or web service | Call an HTTP endpoint and return its response payload as an attribute value. Use when your attribute source exposes a web API rather than a directory or database. |
| Parser (JSON, XML, JWT) | A structured string attribute already present in the request | Extract nested values from a JSON object, XML document, or JWT token that is part of the request. They do not necessarily reach out to external sources to retrieve information. |
For full configuration reference for each connector type, see the Attribute connectors documentationOpens in a new tab.
How connectors work in an evaluation request
When ADS receives an authorization request, it follows this sequence:
- ADS loads the active authorization domain and identifies which attributes the applicable policies require.
- ADS checks the incoming request for those attribute values.
- For any attribute not present in the request, ADS calls the connector configured to provide that attribute.
- The connector queries the external system (LDAP directory, database, HTTP endpoint, or parses an existing value) and returns the result to ADS.
- ADS uses all collected attribute values to evaluate the policies and produces a final decision: Permit, Deny, Not Applicable, or Indeterminate.
- ADS returns the decision to the Policy Enforcement Point (PEP).
If you have configured an attribute cache in the domain, ADS stores retrieved values for subsequent requests, reducing the number of external calls.
Custom connectors
You can build custom connectors to fetch attributes from sources that the standard connectors do not support. Custom connectors are also known as Attribute Finders. ADS loads them through the Java ServiceLoader mechanism.
If you use Axiomatics Services Manager (ASM) to build your domain, you also need to make your custom Attribute Finder package available to ASM. This way it shows up as an Attribute connector type you can select in the ASM GUI.