Dictionary

In the context of policy authoring, attributes serve as the fundamental building blocks for defining and enforcing authorization policies, dictating who can access which resources and under what specific circumstances.

The Dictionary serves as a centralized repository of attributes, a common vocabulary used to describe authorization policies. Within the dictionary, you can define and organize attributes needed to express your authorization policies.

All of your attributes are contained in the auto-generated attribute-dictionary.alfa file. This file gets populated automatically the time you open the Policies section with the attributes existing at this moment in the Dictionary. When you save your policy, this attribute dictionary "snapshot" is saved along with the other ALFA resources.

note

This saving action occurs whether you use Save or Save all.

Interface

Upon accessing the Dictionary, you are presented with a comprehensive list of all existing attributes. This interface consists of the following key information about the attributes included in the dictionary:

	Description
Name	The user-friendly name of an attribute, serving as a readily identifiable label for its purpose and usage. For instance, "role" is a common attribute name used to represent a user's assigned position within an organization.
Description	A brief overview of the attribute's purpose or scope.
Namespace	A hierarchical structure used to organize attributes into logical groups. It consists of a sequence of one or more case-sensitive strings delimited by dots (.). Namespaces can be nested within one another, following the standard dot-notation conventions found in languages such as Java and C#. INFO: Namespaces define the scope for your attributes, providing each with a unique identifier. Attributes are accessed using their Fully Qualified Name (FQN), which is constructed by joining the namespace and the attribute name with a dot (.).
Data type	The specific type of data an attribute holds, such as string, integer, or boolean.
Category	A property that provides additional context and classification information such as subject, action, resource, or environment.
XACML ID	The identifier that PEPs send in authorization requests to identify the attribute. By default, it is the same as the attribute's FQN, but it can be set to a different value. Read Add a new attribute and Manage attributes for details.
Cache profile	The cache profile applied along with the specified Time to live and Max items values. Read the Cache configuration section for details.
Updated by	The Authorization Hub user or M2M client that updated the attribute last.
Last updated	The date and time of the last update performed on the attribute's properties.
Attribute connectors	See "Attribute mapping" below for details.

By default, the Attribute connectors, Cache profile, and XACML ID columns are hidden. Use the column selector (see below) to show them.

Additionally, the following features are available in this section to help you manage your attributes effectively:

• Filter: Use the filter field to refine the list and narrow down the displayed attributes in your dictionary. You can enter an attribute name, part of a description, or a category.

  note

  This is a dynamic field and returns relevant results as you type.

  You can further narrow down your filter by selecting one or more namespaces from the Namespaces dropdown.

• Sorting: Sort the contents of the list by column values by clicking the header of the column whose contents you want to sort by.

  tip

  You can see the applied direction on the header's arrow indicator.

• Column selection: Use the column selector above the list to choose which columns display. The Name and actions columns cannot be hidden, and your changes take effect immediately. Your selection is remembered for this list in your browser, so it persists across page reloads and navigation, but it is not shared with other browsers, devices, or users. Use the reset option to return to the default columns.

• Attribute mapping: The attribute mapping icon in the Attribute connectors column lists all attribute connectors having that specific attribute provided to the authorization engine in order to retrieve the corresponding values from the attribute source.

  note

  A single attribute can be mapped by multiple attribute connectors.

  

• Draft indicator: Attributes with unsaved changes in My workspace are marked with a vertical orange line. Attributes staged for deletion are hidden from this list until you save to project or discard the change.

• Export and import: Use the Actions menu to export all attributes to a JSON file, or to import attributes from a file into the project. Imported attributes are saved to My workspace as pending changes. Read Import and export for details.

Manage attributes

You can perform several actions to your existing attributes by clicking the three dots on the far right of each entry and selecting from:

• Edit

  1. Perform all necessary changes in the displayed pop-up window.

  2. Click Update.

  warning

  PEPs, attribute connectors, and historical logs may already reference an attribute's current XACML ID. Changing it may break existing integrations (PEPs and attribute connectors relying on the old ID) and make historical logs inconsistent.

• Duplicate

  A clone of the attribute is created with the prefix Copy_of_ added to its name.

• Delete

  Confirm your action in the displayed pop-up by clicking Yes, delete.

Default attributes

The Dictionary comes preloaded with commonly used attributes categorized under Subject, Resource, Action, and Environment. This selection helps you start authoring policies quickly and serves as a guide for how the attribute dictionary should be populated.

The default attributes are included with every deployment and are also accessible through the attribute-dictionary.alfa file.

All default attributes, except for the three environment attributes, can be edited or deleted allowing you to tailor the dictionary to your specific needs. The three environment attributes (Attributes.currentTime, Attributes.currentDate, and Attributes.currentDateTime) represent the current time, date, and date-time captured by the Policy Decision Point (PDP) during policy evaluation. Their correct functioning is fundamental for reliable evaluation of time-based policies and therefore, they cannot be edited or deleted.

API reference

The Authorization Hub REST API interactive documentation is available in the Swagger UI API. You can access the API schemas and endpoint definitions for the dictionary service, in the Dictionary definition, using the following URL:

http(s)://<authorization-hub-url>/api/hub-service/swagger-ui/index.html

Read the Dictionary endpoint reference for descriptions of the endpoints for attributes, namespaces, and cache profiles, including their validation rules and errors. While My workspace is enabled, changes made through the API are staged in your workspace. Read My workspace and the API for details.