Page Comparison

For entitlement management, WSO2 Identity server provides two APIs for Policy Administration and Policy Evaluation.

...

You can use the following URL in your browser to see the WSDL of the EntitlementPolicyAdminService admin service.

Code Block
https://localhost:9443/services/EntitlementPolicyAdminService?wsdl

By using any SoapUI, you can call this admin SOAP service.

Note

Note:

All the APIs are secured with basic authentication. Follow the steps below to add a basic auth header when calling these methods.

Build a string of the form username:password.
Encode the string you created above using Base64.
Define an authorization header with the term "Basic_", followed by the encoded string. For example, the basic auth authorization header using "admin" as both username and password is as follows:
Code Block
Authorization: Basic YWRtaW46YWRtaW4=

Operations included in the EntitlementPolicyAdminService SOAP API

The following commonly used operations are available in the EntitlementPolicyAdminService. A sample SOAP request and response will be available with each of the operation.

Table of Contents

maxLevel	6
minLevel	6

addPolicy()

Description

Adds a new policy.

Input Parameters

Parameter	Description
policy	The policy that should be registered. The XACML policy should be embedded to the SOAP service as a CDATA.
version	Version of the policy.
policyId	The policy name that should be registered.

Request

Expand

title	Click here to see the request

Code Block

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://org.apache.axis2/xsd" xmlns:xsd1="http://dto.entitlement.identity.carbon.wso2.org/xsd">
   <soapenv:Header/>
   <soapenv:Body>
      <xsd:addPolicy>
         <!--Optional:-->
         <xsd:policyDTO>
            <!--Optional:-->
            <xsd1:policy><![CDATA[
				   <Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"  PolicyId="sample_policy_template" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
				   <Description>This policy template provides ability to authorize users to a given service provider(defined by SP_NAME) in the authentication flow based on the roles of the user (defined by ROLE_1 and ROLE_2). Users who have at least one of the given roles, will be allowed and any others will be denied.</Description>
				   <Target>
				      <AnyOf>
				         <AllOf>
				            <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
				               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">SP_NAME</AttributeValue>
				               <AttributeDesignator AttributeId="http://wso2.org/identity/sp/sp-name" Category="http://wso2.org/identity/sp" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"></AttributeDesignator>
				            </Match>
				         </AllOf>
				      </AnyOf>
				   </Target>
				   <Rule Effect="Permit" RuleId="permit_by_roles">
				      <Condition>
				         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
				            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
				               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ROLE_1_1_1</AttributeValue>
				               <AttributeDesignator AttributeId="http://wso2.org/claims/role" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
				            </Apply>
				         </Apply>
				      </Condition>
				   </Rule>
				   <Rule Effect="Deny" RuleId="deny_others"></Rule>
				</Policy>        
				]]>
			</xsd1:policy>
            <!--Optional:-->
            <xsd1:version>1.0</xsd1:version>
            <xsd1:policyId>sample_policy_template</xsd1:policyId>
         </xsd:policyDTO>
      </xsd:addPolicy>
   </soapenv:Body>
</soapenv:Envelope>

Response

Expand

title	Click here to see the sample response

Code Block

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
   <soapenv:Body>
      <ns:addPolicyResponse xmlns:ns="http://org.apache.axis2/xsd">
         <ns:return xsi:nil="true" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"/>
      </ns:addPolicyResponse>
   </soapenv:Body>
</soapenv:Envelope>

...

You can use the following URL in your browser to see the WSDL of the EntitlementService admin service.

Code Block
https://localhost:9443/services/EntitlementService?wsdl

By using any SoapUI, you can call this admin SOAP service.

Note

Note:

All the APIs are secured with basic authentication. Follow the steps below to add a basic auth header when calling these methods.

Build a string of the form username:password.
Encode the string you created above using Base64.
Define an authorization header with the term "Basic_", followed by the encoded string. For example, the basic auth authorization header using "admin" as both username and password is as follows:
Code Block
Authorization: Basic YWRtaW46YWRtaW4=

Operations included in

...

The following commonly used operations are available in the EntitlementPolicyAdminService. A sample SOAP request and response will be available with each of the operation.

Table of Contents

maxLevel	4
minLevel	4
type	flat

Note

Note:

The REST APIs are secured with basic authentication. Follow the steps below to add a basic auth header when calling these methods.

Build a string of the form username:password.
Encode the string you created above using Base64.
Define an authorization header with the term "Basic_", followed by the encoded string. For example, the basic auth authorization header using "admin" as both username and password is as follows:
Code Block
Authorization: Basic YWRtaW46YWRtaW4=

Get API resource list

...

application/xml

...

Name	Located In	Description	Required	Schema
Accept	header	Request Media Type	Yes	string
Auth_Type	header	Authentication Type	Yes	string
Authorization	header	Add HTTP Basic Authorization	Yes	string
Content-type	header	Response Media Type	Yes	string

...

ExceptionBean {

code:integer

message:string

...

Evaluate XACML request

...

application/json

application/xml

...

Name	Located In	Description	Required	Schema
Accept	header	Request Media Type	Yes	string
Auth_Type	header	Authentication Type	Yes	string
Authorization	header	Add HTTP Basic Authorization	Yes	string
Content-type	header	Response Media Type	Yes	string
body	body	XACML JSON/XML Request	Yes	string

...

ExceptionBean {
	code:integer
	message:string
}

...

ExceptionBean {
	code:integer
	message:string
}

Evaluate XACML request by attributes

...

application/xml

...

Name	Located In	Description	Required	Schema
Accept	header	Request Media Type	Yes	string
Auth_Type	header	Authentication Type	Yes	string
Authorization	header	Add HTTP Basic Authorization	Yes	string
Content-type	header	Response Media Type	Yes	string
body	body	Decision Request Model	Yes	DecisionRequestModel { subject:string action:string resource:string environment:[ string ] }

...

Code	Description	Schema
200	Method call success	`HomeResponseModel { }`
40010	Error in Response	ExceptionBean { code:integer message:string }
40020	Request parse exception	ExceptionBean { code:integer message:string }

Evaluate XACML request by attributes and receive boolean response

...

application/json

application/xml

...

Name	Located In	Description	Required	Schema
Accept	header	Request Media Type	Yes	string
Auth_Type	header	Authentication Type	Yes	string
Authorization	header	Add HTTP Basic Authorization	Yes	string
Content-type	header	Response Media Type	Yes	string
body	body	Decision Request Model	Yes	DecisionRequestModel { subject:string action:string resource:string environment:[ string ] }

...

ExceptionBean {
	code:integer
	message:string
}

...

ExceptionBean {
	code:integer
	message:string
}

Get entitled attributes

Description

Get entitled attributes for a given set of parameters.

Resource Path

/entitled-attribs

HTTP Method

POST

Request/Response Format

application/json

application/xml

Authentication

Basic

Username

admin

Password

admin

Parameters

Name	Located In	Description	Required	Schema
Accept	header	Request Media Type	Yes	string
Auth_Type	header	Authentication Type	Yes	string
Authorization	header	Add HTTP Basic Authorization	Yes	string
Content-type	header	Response Media Type	Yes	string
body	body	Decision Request Model	Yes	EntitledAttributesRequestModel { subjectName:string resourceName:string subjectId:string action:string enableChildSearch:boolean }

Response

Code

Description

Schema

200

Entitled attributes response

EntitledAttributesResponseModel {
	entitledResultSetDTO:EntitledResultSetDTO {
		entitledAttributesDTOs:[
			EntitledAttributesDTO {
				resourceName:string
				action:string
				environment:string
				allActions:boolean
				allResources:boolean
				attributeDTOs:[
					AttributeDTO {
						attributeValue:string
						attributeDataType:string
						attributeId:string
						category:string
					}
				]
			}
		]
		advanceResult:boolean
		message:string
		messageType:string
	}
}

40010

Error in Response

ExceptionBean {
	code:integer
	message:string
}

40020

Request parse exception

ExceptionBean {
	code:integer
	message:string
}

Get all entitlements

...

application/json

application/xml

...

Name	Located In	Description	Required	Schema
Accept	header	Request Media Type	Yes	string
Auth_Type	header	Authentication Type	Yes	string
Authorization	header	Add HTTP Basic Authorization	Yes	string
Content-type	header	Response Media Type	Yes	string
body	body	All Entitlements Model	Yes	AllEntitlementsRequestModel { identifier:string givenAttributes:[ AttributeDTO { attributeValue:string attributeDataType:string attributeId:string category:string } ] }

...

AllEntitlementsResponseModel {
	entitledResultSetDTO:EntitledResultSetDTO {
		entitledAttributesDTOs:[
			EntitledAttributesDTO {
				resourceName:string
				action:string
				environment:string
				allActions:boolean
				allResources:boolean
				attributeDTOs:[
					AttributeDTO {
						attributeValue:string
						attributeDataType:string
						attributeId:string
						category:string
					}
				]
			}
		]
		advanceResult:boolean
		message:string
		messageType:string
	}
}

...

ExceptionBean {
	code:integer
	message:string
}

...

EntitlementService SOAP API

Note

title	Before you begin,

In order to try this EntitlementService using SOAP UI, You need to publish a Policy to the PDP. For this, you can use EntitlementPolicyAdminService or management console UI.

We use the following sample policy to evaluate using EntitlementService admin service.

Code Block

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="samplePolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-overrides" Version="1.0">
	<Target>
		<AnyOf>
			<AllOf>
				<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
					<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
				</Match>
			</AllOf>
		</AnyOf>
	</Target>
	<Rule Effect="Permit" RuleId="permit"/>
</Policy>

The following commonly used operations are available in the EntitlementPolicyAdminService. A sample SOAP request and response will be available with each of the operation.

Table of Contents

maxLevel	6
minLevel	6

getDecision()

Description

Get the decision after evaluating the request with the policy.

Input Parameters

Parameter	Description
request	The XML request to be evaluated as a CDATA

Request

Expand

title	Click here to expand the request

Code Block

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://org.apache.axis2/xsd">
   <soapenv:Header/>
   <soapenv:Body>
      <xsd:getDecision>
         <!--Optional:-->
         <xsd:request><![CDATA[
         <Request CombinedDecision="false" ReturnPolicyIdList="false" xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
 <Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
      <Attribute IncludeInResult="false" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id">
         <AttributeValue DataType="urn:oasis:names:tc:xacml:1.0:data-type:rfc822Name">bs@simpsons.com</AttributeValue>
      </Attribute>
   </Attributes>
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action">
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="false">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
        </Attribute>
    </Attributes>
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="false">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://127.0.0.1/service/very_secure/ </AttributeValue>
        </Attribute>
    </Attributes>
</Request>
         ]]></xsd:request>
      </xsd:getDecision>
   </soapenv:Body>
</soapenv:Envelope>

Response

Expand

title	Click here to expand the responase

Code Block

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
   <soapenv:Body>
      <ns:getDecisionResponse xmlns:ns="http://org.apache.axis2/xsd">
         <ns:return><![CDATA[<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"><Result><Decision>Permit</Decision><Status><StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/></Status></Result></Response>]]></ns:return>
      </ns:getDecisionResponse>
   </soapenv:Body>
</soapenv:Envelope>

getBooleanDecision()

Description

Get the decision after evaluating the request with the policy published in a boolean format.

Input Parameters

Parameter	Description
subject	The subject/user who is using the resource.
resource	The resource which is accessed by the user.
action	The action performed by the user.

Request

Expand

title	Click here to expand the request

Code Block

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://org.apache.axis2/xsd">
   <soapenv:Header/>
   <soapenv:Body>
      <xsd:getBooleanDecision>
         <!--Optional:-->
         <xsd:subject>admin</xsd:subject>
         <!--Optional:-->
         <xsd:resource>http://127.0.0.1/service/very_secure/</xsd:resource>
         <!--Optional:-->
         <xsd:action>read</xsd:action>
      </xsd:getBooleanDecision>
   </soapenv:Body>
</soapenv:Envelope>

Response

Expand

title	Click here to expand the response

Code Block

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
   <soapenv:Body>
      <ns:getBooleanDecisionResponse xmlns:ns="http://org.apache.axis2/xsd">
         <ns:return>true</ns:return>
      </ns:getBooleanDecisionResponse>
   </soapenv:Body>
</soapenv:Envelope>

getDecisionByAttributes()

Description

Get the decision by evaluating attributes with the policy.

Input Parameters

Parameter	Description
subject	The subject/user who is using the resource.
resource	The resource which is accessed by the user.
action	The action performed by the user.

Request

Expand

title	Click here to expand the request

Code Block

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://org.apache.axis2/xsd">
   <soapenv:Header/>
   <soapenv:Body>
      <xsd:getDecisionByAttributes>
         <!--Optional:-->
         <xsd:subject>admin</xsd:subject>
         <!--Optional:-->
         <xsd:resource>http://127.0.0.1/service/very_secure/</xsd:resource>
         <!--Optional:-->
         <xsd:action>read</xsd:action>
      </xsd:getDecisionByAttributes>
   </soapenv:Body>
</soapenv:Envelope>

Response

Expand

title	Click here to expand the response

Code Block

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
   <soapenv:Body>
      <ns:getDecisionByAttributesResponse xmlns:ns="http://org.apache.axis2/xsd">
         <ns:return><![CDATA[<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"><Result><Decision>Permit</Decision><Status><StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/></Status></Result></Response>]]></ns:return>
      </ns:getDecisionByAttributesResponse>
   </soapenv:Body>
</soapenv:Envelope>

EntitlementService

Versions Compared

Old Version 20

New Version 21

Key

Operations included in the EntitlementPolicyAdminService SOAP API

addPolicy()

Operations included in

Get API resource list

Evaluate XACML request

Evaluate XACML request by attributes

Evaluate XACML request by attributes and receive boolean response

Get entitled attributes

Get all entitlements

EntitlementService SOAP API

getDecision()

getBooleanDecision()

getDecisionByAttributes()

Parameter

Description

The subject/user who is using the resource.

resource

The resource which is accessed by the user.

action

The action performed by the user.