XACML Authzforce PDP configuration in multiple policy files

Question

I'm running XACML using the Authzforce PDP engine and a configuration pdp.xml file, that looks like:

<?xml version="1.0" encoding="UTF-8"?>
<pdp xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xmlns="http://authzforce.github.io/core/xmlns/pdp/6.0"
     version="6.0.0">
  <rootPolicyProvider id="rootPolicyProvider"
        xsi:type="StaticRootPolicyProvider" policyLocation="${PARENT_DIR}/policy.xml" />
</pdp>

Now, the file ${PARENT_DIR}/policy.xml, that is read by the PDP engine through the rootPolicyProvider contains the actual XACML policies and is becoming fairly large. So, I would like to divide the XACML policies in multiple files policy1.xml, policy2.xml, policy3.xml, etc. These files then need to be read by the PDP engine.

Does anyone know whether the PDP engine configuration xml-file is able to specify this using multiple policyProviders or otherwise? It shouldn't be too difficult, but I have not found any solution yet after a few hours of search on the web.

Looking forward to your replies.

Thx, Jack.

Answer 1

For this use case, I recommend to upgrade to AuthzForce Core 14.0.0 or later. Then you have two options (beware the XML schema and namespace have changed a bit):

1. Multiple 'policyLocation' elements, for example:

<?xml version="1.0" encoding="UTF-8"?>
<pdp xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://authzforce.github.io/core/xmlns/pdp/7.0" version="7.0.0">
    <policyProvider id="refPolicyprovider" xsi:type="StaticPolicyProvider">
        <policyLocation>${PARENT_DIR}/policy1.xml</policyLocation>
        <policyLocation>${PARENT_DIR}/policy2.xml</policyLocation>
    </policyProvider>
    <rootPolicyRef>policy1</rootPolicyRef>
</pdp>

2. Use a wildcard pattern as 'policyLocation', for example (including all policy files with '.xml' extension):

<?xml version="1.0" encoding="UTF-8"?>
<pdp xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://authzforce.github.io/core/xmlns/pdp/7.0" version="7.0.0">
    <policyProvider id="refPolicyprovider" xsi:type="StaticPolicyProvider">
        <policyLocation>${PARENT_DIR}/*.xml</policyLocation>
    </policyProvider>
    <rootPolicyRef>policy1</rootPolicyRef>
</pdp>

In both cases, the 'rootPolicyRef' identifies the root policy (where the PDP evaluation starts). In this case, the root policy is supposed to combine the other policies, i.e. be a XACML PolicySet with a defined PolicyCombiningAlgId and one or more PolicyIdReferences or PolicySetIdReferences to the other policies.

You can find a full example using the wildcard option on authzforce github.

Also you can find more info about the PDP configuration format (latest version) in the XML schema.