Authorization domain layout

The src/authorizationDomain directory holds the sources of your authorization domain. buildAuthzDomain builds them into a single YAML file, build/alfa/domain/ads/domain.yaml, in the domain format of ADS. Each file or folder becomes one section of the domain:

File or folder	Section of domain.yaml
metadata.yaml	metadata
alfaSpecifications/	policy
attributes.yaml	attributes
attributeConnectors/	attributeConnectors
attributeCache.yaml	attributeCache
decisionParameters.yaml	decisionParameters

APD sets the identity of the domain itself, from Git or from domainIdentity in build.gradle, see Traceability.

To leave a section out of the domain, delete its file or folder.

warning

Except for metadata.yaml, an empty file gives a section with the YAML value null, which is invalid for all sections.

metadata.yaml

Your own metadata of the domain, as key-value pairs. For example:

metadata.yaml

status: under development
createdBy: Bob
approvedBy: Alice

APD adds the Git commit message, the author, and the identity of the domain (Git-Identity) to it. The file can be empty.

alfaSpecifications/

The ALFA policies. APD compiles all files in this directory to XACML for the policy section. The main policy of the domain is the one set with mainpolicy in build.gradle.

attributes.yaml

The attribute dictionary. For example:

attributes.yaml

acme.role:
  xacmlId: acme.role
  category: AccessSubject
  datatype: string
acme.resource.identity:
  xacmlId: acme.resource.identity
  category: Resource
  datatype: string

See Create the dictionary.

attributeConnectors/

One YAML file for each attribute connector. The file name, without .yaml, is the name of the attribute connector in the domain: userDirectory.yaml becomes userDirectory in the attributeConnectors section. Use the same name as identifier in the configuration of the attribute connector. See Create the attribute connectors.

You can also put the configuration of an attribute connector in a separate file, for example when it is large: leave configuration out of userDirectory.yaml, and write it in userDirectory.configuration.yaml.

:::note Legacy format Attribute connectors in the legacy format have a configurationString with an XML configuration, in the YAML file or in a separate file such as userDirectory.configurationString.xml. To convert them to the current format, see Upgrade legacy attribute connectors. :::

attributeCache.yaml

How long ADS caches the values of attributes, and how many. For example:

attributeCache.yaml

acme.role:
  timeToLive: 1 day
  maxItems: 1000
acme.resource.identity:
  timeToLive: 15 minutes
  maxItems: 1000

decisionParameters.yaml

Parameters for the evaluation of decisions by ADS. For example:

decisionParameters.yaml

partialEvaluationThreshold: 3

For all settings of the sections, see the domain format of ADS.