Welcome to AuthzForce’s official documentation

This project is part of FIWARE. You will find more information about this FIWARE GE at the Catalogue.

Table of Contents

• 1. Introduction
• 2. Release Notes
• 3. Features
  • 3.1. PDP (Policy Decision Point)
    • 3.1.1. XACML Standard Compliance
      • 3.1.1.1. XACML Core Specification
        • 3.1.1.1.1. Schema elements
        • 3.1.1.1.2. Algorithms
        • 3.1.1.1.3. Status Codes
        • 3.1.1.1.4. Attributes
        • 3.1.1.1.5. Data-types
        • 3.1.1.1.6. Functions
      • 3.1.1.2. XACML RBAC Profile
      • 3.1.1.3. XACML Multiple Decision Profile
      • 3.1.1.4. XACML Data Loss Prevention / Network Access Control Profile
      • 3.1.1.5. XACML Additional Combining Algorithms Profile
      • 3.1.1.6. XACML REST Profile
      • 3.1.1.7. XACML JSON Profile
    • 3.1.2. Safety & Security
    • 3.1.3. Performance
    • 3.1.4. Extensibility Points
  • 3.2. PAP (Policy Administration Point)
  • 3.3. REST API
  • 3.4. High availability and load-balancing
  • 3.5. Limitations
• 4. Installation and Administration Guide
  • 4.1. System Requirements
  • 4.2. Installation
    • 4.2.1. Minimal setup
    • 4.2.2. Upgrade
    • 4.2.3. Advanced setup
  • 4.3. Administration
    • 4.3.1. Tomcat
    • 4.3.2. Authzforce webapp
    • 4.3.3. Fast Infoset mode
    • 4.3.4. Policy Domain Administration
      • 4.3.4.1. The Concept of Policy Domain
      • 4.3.4.2. Default Domain Settings
      • 4.3.4.3. Domain Creation
      • 4.3.4.4. Domain Removal
  • 4.4. High Availability
  • 4.5. Sanity check procedures
    • 4.5.1. End to End testing
    • 4.5.2. List of Running Processes
    • 4.5.3. Network interfaces Up & Open
    • 4.5.4. Databases
  • 4.6. Diagnosis Procedures
    • 4.6.1. Resource availability
    • 4.6.2. Remote Service Access
    • 4.6.3. Resource consumption
    • 4.6.4. I/O flows
  • 4.7. Appendix
    • 4.7.1. Security setup for production
      • 4.7.1.1. Server Security Setup
      • 4.7.1.2. Certificate Authority Setup
      • 4.7.1.3. Server SSL Certificate Setup
      • 4.7.1.4. Web Application Secutity
        • 4.7.1.4.1. XML Security
        • 4.7.1.4.2. Disabling unused features
      • 4.7.1.5. User and Role Management Setup
      • 4.7.1.6. Domain Role Assignment
    • 4.7.2. Performance Tuning
• 5. User and Programmers Guide
  • 5.1. Background and Detail
  • 5.2. User Guide
  • 5.3. Programmer Guide
    • 5.3.1. General recommendations for developers
    • 5.3.2. Attribute-Based Access Control
    • 5.3.3. Product info API
    • 5.3.4. Domain Management API
    • 5.3.5. Policy Administration API
      • 5.3.5.1. Adding and updating Policies
      • 5.3.5.2. Getting Policies and Policy Versions
      • 5.3.5.3. Removing Policies and Policy Versions
      • 5.3.5.4. Re-usable Policies (e.g. for Hierarchical RBAC)
      • 5.3.5.5. Policy Repository (PRP) Properties
      • 5.3.5.6. Policy Decision (PDP) Properties
      • 5.3.5.7. PDP Extensions
        • 5.3.5.7.1. Attribute Datatype extensions
          • 5.3.5.7.1.1. Making an Attribute Datatype extension
          • 5.3.5.7.1.2. Integrating an Attribute Datatype extension into AuthzForce Server
          • 5.3.5.7.1.3. Enabling an Attribute Datatype extension on a domain
        • 5.3.5.7.2. Function Extensions
          • 5.3.5.7.2.1. Making a Function extension
          • 5.3.5.7.2.2. Integrating a Function extension into AuthzForce Server
          • 5.3.5.7.2.3. Enabling a Function extension on a domain
        • 5.3.5.7.3. Combining Algorithm Extensions
          • 5.3.5.7.3.1. Making a Combining Algorithm extension
          • 5.3.5.7.3.2. Integrating a Combining Algorithm extension into AuthzForce Server
          • 5.3.5.7.3.3. Enabling a Combining Algorithm extension on a domain
        • 5.3.5.7.4. Request Filter Extensions
          • 5.3.5.7.4.1. Making a Request Filter extension
          • 5.3.5.7.4.2. Integrating a Request Filter extension into AuthzForce Server
          • 5.3.5.7.4.3. Enabling a Request Filter extension on a domain
        • 5.3.5.7.5. Result Filter Extensions
          • 5.3.5.7.5.1. Making a Result Filter extension
          • 5.3.5.7.5.2. Integrating a Result Filter extension into AuthzForce Server
          • 5.3.5.7.5.3. Enabling a Result Filter extension on a domain
        • 5.3.5.7.6. Attribute Providers
          • 5.3.5.7.6.1. Making an Attribute Provider
          • 5.3.5.7.6.2. Integrating an Attribute Provider into AuthzForce Server
          • 5.3.5.7.6.3. Managing attribute providers configuration
    • 5.3.6. Policy Decision API
    • 5.3.7. Fast Infoset
    • 5.3.8. Integration with the IdM and PEP Proxy GEs (e.g. for OAuth)
    • 5.3.9. Software Libraries for clients of AuthzForce or other Authorization PDP GEis