Glossary

A

Access control

A mechanism that decides whether a given actor (user, service, or system) is allowed to perform a specific action on a resource, based on a defined policy or policy set.

See also: Policy, Authorization decision

ADS

Access Decision Service. The Axiomatics product that hosts a Policy Decision Point (PDP) and evaluates XACML policies. See also: PDP.

ALFA

Abbreviated Language for Authorization. A domain-specific language for writing XACML policies. ALFA uses a compact, code-like syntax that makes policies readable to developers and compiles to standard XACML 3.0.

See also: XACML, Policy

ASM

Axiomatics Services Manager. The Axiomatics management console used to create, manage, and publish authorization domains, policies, and attribute connectors.

Attribute

A named value that describes one of four aspects of an authorization request:

• Subject attributes: describe the actor making the request (for example, user.role = "manager").
• Resource attributes: describe the object being accessed (for example, document.classification = "confidential").
• Action attributes: describe the operation being performed (for example, action.id = "read").
• Environment attributes: describe the context of the request (for example, time.of.day = "09:00").

Attributes appear in policy Targets and Conditions.

See also: Target, Condition, Environment attribute

Attribute Connector

A component that connects ADS to an external source of attribute values, such as an LDAP directory or a SQL database. During policy evaluation, ADS queries attribute connectors to retrieve values that are not included in the incoming authorization request.

See also: PIP, Authorization Domain

Authorization decision

The outcome ADS returns after evaluating a policy against an authorization request. A decision is one of four values defined by the XACML standard:

• Permit: the request is allowed.
• Deny: the request is denied.
• Indeterminate: an error occurred during evaluation and no decision could be reached.
• NotApplicable: no policy in the policy set matched the request.

A decision may also include obligations and advice.

See also: PDP, PEP, Effect

Authorization Domain

A bundle of configuration that ADS loads at startup to evaluate access requests. A domain contains:

• One or more XACML policies
• Attribute connector definitions
• Cache configuration (optional)

ADS evaluates every incoming request against the domain currently loaded.

See also: Attribute Connector, Policy Set

AuthZEN

An emerging open standard for authorization APIs. ADS exposes AuthZEN-compatible endpoints for authorization evaluation.

C

CAQ

Contextual Authorization Query. A reverse-query capability built into ADS. A forward query asks "is this request permitted?" A CAQ reverse query asks "which requests would result in a given decision?" CAQ is available when ADS runs in caq or ads_caq mode.

See also: PDP

Combining algorithm

A rule that resolves conflicts when multiple policies or rules return different decisions for the same request. For example:

• deny-overrides: a single Deny result overrides any number of Permit results. The final decision is Deny.
• permit-overrides: a single Permit result overrides any number of Deny results. The final decision is Permit.
• first-applicable: ADS returns the decision of the first rule or policy whose target matches, ignoring any others.

One set of combining algorithms applies to Policy Sets and Policies. Another applies to Rules within a Policy.

See also: Policy, Rule, Effect

Condition

An optional expression inside a Rule that must evaluate to true for the Rule's Effect to apply. Conditions can compare attribute values, call functions, and nest logic. If a Condition evaluates to false, the Rule result is NotApplicable. If evaluation fails due to an error, the result is Indeterminate.

See also: Rule, Effect, Attribute

E

Effect

The decision value declared by a Rule: either Permit or Deny. When a Rule's Target matches the request and its Condition evaluates to true, ADS applies the Rule's Effect. The Policy's combining algorithm then combines all Rule Effects to produce the Policy's final decision.

See also: Rule, Combining algorithm, Authorization decision

Environment attribute

An attribute that describes the context surrounding an access request, independent of the subject, resource, or action. Common examples include the current date or time, the authentication method used, and the device or network from which the request originated.

See also: Attribute

P

PDP

Policy Decision Point. The component that receives an authorization request, evaluates it against the applicable XACML policies, and returns an authorization decision. ADS hosts the PDP.

See also: PEP, Authorization decision, XACML

PEP

Policy Enforcement Point. The component in the system being protected that intercepts an access request, forwards it to the PDP for a decision, and then enforces that decision, for example by blocking a request or allowing it to proceed.

See also: PDP, Authorization decision

PIP

Policy Information Point. An abstract term from the XACML reference architecture for any component that supplies attribute values during policy evaluation. In ADS, Attribute Connectors are the concrete implementation of PIPs.

See also: Attribute Connector

Policy

A container that groups one or more Rules under a shared Target. ADS evaluates a Policy's Rules when the Policy's Target matches the incoming request. A Policy uses a combining algorithm to produce a single decision from all its Rules' results. Unlike a Policy Set, a Policy cannot contain other Policies or Policy Sets: only Rules.

See also: Policy Set, Rule, Target, Combining algorithm

Policy Set

A container that groups one or more Policies or other Policy Sets under a shared Target. ADS evaluates a Policy Set when its Target matches the incoming request. A Policy Set uses a combining algorithm to produce a single decision from all its children. Unlike a Policy, a Policy Set cannot contain Rules directly.

See also: Policy, Target, Combining algorithm

R

Rule

The most granular unit of authorization logic in XACML. A Rule belongs to a Policy and declares an Effect (Permit or Deny). A Rule can have a Target, a Condition, or both. ADS evaluates the Rule's Condition only when the request matches the Rule's Target. Rules can also carry Obligations and Advice that the PEP must or should fulfil.

See also: Policy, Effect, Condition, Target

T

Target

A matching expression on a Policy Set, Policy, or Rule that determines whether that element is considered during evaluation. A Target compares attribute values against constant values, for example resource.country = "France". If the request carries a matching attribute value, the element is evaluated. If not, ADS skips the element and its result is NotApplicable.

See also: Policy, Rule, Attribute

X

XACML

eXtensible Access Control Markup Language. An OASIS open standard that defines:

1. A policy language for writing attribute-based access control rules.
2. A request/response protocol for querying a PDP and receiving authorization decisions.
3. A reference architecture describing the roles of the PDP, PEP, and PIP components.

XACML policies evaluate to Permit, Deny, Indeterminate, or NotApplicable. ADS implements a full XACML 3.0 PDP.

See also: PDP, PEP, PIP, ALFA