The most recent patch for this version is 26.2.1.  Learn more

Skip to main content
Version: 26.2

Authorization domains

What is an authorization domain?​

An authorization domain is a self-contained package that holds everything ADS needs to evaluate access requests: the policies that express your access rules, the attribute definitions that describe the vocabulary those policies use, and the connectors that fetch live attribute values from external systems.

When ADS receives an authorization request, it loads the active domain and uses its contents to evaluate the request. Keeping all of this in one domain makes it straightforward to version, export, and deploy your authorization configuration as a unit.

Domains are defined in YAML and can be created and exported from the Axiomatics Services Manager (ASM). Once exported, you point ADS at the domain file through the deployment configuration.

Domain components​

A domain groups the following data:

ComponentPurpose
PoliciesThe set of rules that define access logic: who can do what, under which conditions. A domain must contain at least one policy. ADS will not start without one.
AttributesThe vocabulary of the authorization system. Attributes describe the subject (user), resource, action, and environment involved in an access request.
Attribute connectorsComponents that link to external data sources (databases, LDAP directories, HTTP services) to fetch attribute values at decision time.
Attribute cacheA cache that stores attribute values retrieved from connectors, reducing repeat lookups and improving performance.
Partial evaluation thresholdA tuning parameter. When a multiple-decision request contains at least this many individual requests, ADS attempts to optimize evaluation. The value must be an integer of 2 or higher.

Define a domain in YAML​

The domain configuration file uses YAML format. The structure below illustrates a complete domain file.

note

For a detailed reference of every section and field in the domain file, see the Authorization domain file analysis section of the Authorization Domain Manager (ADM) documentationOpens in a new tab.

Validation rules​

ADS validates the domain file on startup. If validation fails, ADS logs an error and does not start. The rules are:

SectionValidation behavior
IdentityADS cannot initialize if the identity property is missing.
MetadataADS checks only structural integrity. It ignores the content.
PolicyADS will not start if the domain contains no policy.
AttributesDuplicate attribute identifiers and duplicate XACML quadruples are not allowed.
Attribute connectorsADS passes configuration data directly to the connector at initialization. It does not verify that the configurationString value is functional.

Decision parameters​

The decisionParameters section controls multiple-request optimization. When enabled, ADS attempts to optimize requests that meet the threshold. Whether this improves performance depends on the structure of the request and the policy.

decisionParameters:
  partialEvaluationThreshold: 2  # minimum individual requests before ADS optimizes a multiple-decision request

Set the threshold too low and ADS may attempt optimization where it offers no benefit, reducing performance. Set it too high and the threshold may never be reached.

Full domain file example​

The following example shows a domain file with an identity, an embedded XACML policy, and attribute definitions.

identity: a1b2c3d4-e5f6-7890-abcd-ef1234567890

metadata: {}

policy:
  mainPolicyId: my-policy-set
  xacmlSpecifications:
    - |
      <PolicySet PolicySetId="my-policy-set"
          PolicyCombiningAlgId="urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-overrides"
          xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" Version="1.0">
        <!-- policy content -->
      </PolicySet>

attributes:
  user.department:
    xacmlId: user.department
    category: 'urn:oasis:names:tc:xacml:1.0:subject-category:access-subject'
    datatype: 'http://www.w3.org/2001/XMLSchema#string'
    issuer: ''
  resource.classification:
    xacmlId: resource.classification
    category: 'urn:oasis:names:tc:xacml:3.0:attribute-category:resource'
    datatype: 'http://www.w3.org/2001/XMLSchema#string'
    issuer: ''
  action.name:
    xacmlId: action.name
    category: 'urn:oasis:names:tc:xacml:3.0:attribute-category:action'
    datatype: 'http://www.w3.org/2001/XMLSchema#string'
    issuer: ''

attributeConnectors: {}

decisionParameters:
  partialEvaluationThreshold: 2

Deploy the domain file​

After creating the domain file, make it available to ADS by setting the domain property in the deployment configuration file.

See Authorization domain configuration for instructions.

See also​