PEPs and requests

A Policy Enforcement Point (PEP) is the part of an application that asks ADS for an authorization decision, and enforces it: it allows or denies the access, and carries out the obligations in the response. The PEP sends an access request with the attributes of the user, the resource, and the action to ADS over HTTP, in the JSON Profile of XACML 3.0 Version 1.1Opens in a new tab.

This page describes how to send a request to ADS, and what your APD project gives the developers of the PEPs.

Send a request to ADS

ADS receives access requests with POST on /authorize, by default on port 8080 and with Basic authentication. Both are set in deployment.yaml, with the environment variables ADS_PORT, ADS_USERNAME, and ADS_PASSWORD.

For example, to send a request to an ADS started with runAds:

curl -u pdp-user:$ADS_PASSWORD \
     -H "Content-Type: application/json" \
     -d @build/alfa/tests/trace/shouldGiveCeciliaAccessToResource1_request.json \
     http://127.0.0.1:8080/authorize

ADS returns the decision, with the advice and obligations of the policies:

{"Response":[{"Decision":"Permit", ... }]}

What APD gives PEP developers

The PEP and the policies must use the same attributes, with the same ids, categories, and data types. Your APD project holds this contract, and you can give it to the developers of the PEPs:

• The Java dictionary: generateJavaDictionaryFromYaml generates src/test/java/apd/Dictionary.java from attributes.yaml, with a constant for the id, category, and data type of each attribute. It is plain Java without dependencies, so a Java PEP can use it as it is. The javadoc of the class names the commit it was generated from. See Create the dictionary.
• Example requests and responses: for each test on the embedded policy engine, APD writes the request that the test sent and the response it got to build/alfa/tests/trace/, as <test method>_request.json and <test method>_response.json. These are requests for your own policies, in the format ADS expects, so you can send them to ADS as they are, as in the example above. APD writes them together with the visual trace: not when visual tracing is turned off, and not for tests against a running ADS. See Visual tracing.

Tools

• OpenAPI specification: the OpenAPI specification of the authorization serviceOpens in a new tab describes the requests and responses of ADS. Use it to generate client code, or import it into tools such as Postman.
• Java PEP SDK: the Java PEP SDKOpens in a new tab builds requests and reads responses in the JSON Profile of XACML for a Java application.