Page Comparison

...

Role-based resource authorization

In WSO2 App Manager, the Web application invocation requests are authorized and access is granted based on the role assigned to the user. This is called role-based resource authorization. While In the Step 2 - Policies of creating a Web application in the App Publisher, you can associate roles for each Web application resourceresources, in the Web Application Resource section. You can associate user roles with by defining Accessible User Roles in the resource policy as shown below.

Image Added

After defining the accessible user roles in the resource policy as shown above, you can associate that policy to the HTTP verbs of URL patterns in either default resources or newly added resources as shown below. 

Image Removed

For the Step 3 - Web Application Resources section. For example, if you are adding a

the resource to a Web application with the value policy created above to the GET HTTP verb of the /{context}/{version}/timeTables as the URL pattern and GET as the HTTP verb, associating roleA as the user role to it, as shown below, then a HTTP GET request sent to to /{context}/{version}/timeTables is  is authorized only for a user with roleA.users of member and admin roles.

Image Added

XACML policy based resource authorization

XACML is a widely used authorization mechanism for Web resources. XACML provides fine grained policy-based access control. WSO2 App Manager provides Web application resource authorization facility with the use of XACML policies associated with resources.

Defining the XACML policy conditions

Follow the below steps to define the conditions of a XACML-based resource policy.

1. Log in to the admin dashboard of WSO2 App Manager using admin/admin credentials and the following URL: https://localhost:9443/admin-dashboard
2. Click Add XACML Policy.

...

1. Enter a name for the XACML policy.
2. Enter a description for the XACML policy.

3.  Define the conditions of the XACML policy in the provided editor as shown below.

   Info
   For more information on defining XACML policies, see OASIS XACML Version 3.0 documentation.

   Image Added

4. Click New to define a new policy without saving the existing content.
5. Click Validate to check the validity of the policy. It checks for syntax errors and verifies whether the condition adheres to XACML policy language specifications. 

6. Click Save to save the policy condition details. When the policy is saved, it gets listed under the list of XACML policies as shown below.
   Image Added
   You can edit and delete defined XACML policies using the provided buttons under the Action column as shown above.

   Info
   Only the author of the policy can edit shared policies.

Associating XACML policies with Web application resources

When creating a Web application, you can Follow the steps below to associate the defined XACML policies with the HTTP verbs of the URL Pattern of it in the Web Application Resource Web application resources when creating a Web application.

 in the Step 2 - Policies

Step 3 - Web Application Resources section. In the Access Policy section of a Web URL pattern, select the policy, and then select Permit or Deny as shown below. If you select Permit, the user will be permitted to access, and if you select Deny, the Web app resource access will be denied.

...