Web Application Resource Authorization

WSO2 App Manager facilitates Web application authorization for reliability and security of Web applications. Users can enable different levels of access rights and authorization for a single Web application resource. When authorization is enabled, users can access that resource based on the authorization policies or granted permissions. WSO2 App Manager has two types of authorization mechanisms as follows.

Role-based resource authorization

In WSO2 App Manager, the Web application invocation requests are authorized and access is granted based on the role assigned to the user. This is called role-based resource authorization. In the Step 2 - Policies of creating a Web application in the App Publisher, you can associate roles for Web application resources, by defining Accessible User Roles in the resource policy as shown below.

After defining the accessible user roles in the resource policy as shown above, you can associate that policy to the HTTP verbs of URL patterns in the Step 3 - Web Application Resources section. For example, if you are adding the resource policy created above to the GET HTTP verb of the /{context}/{version}/timeTables URL pattern as shown below, then a HTTP GET request sent to /{context}/{version}/timeTables is authorized only for a users of member and admin roles.

XACML policy based resource authorization

XACML is a widely used authorization mechanism for Web resources. XACML provides fine grained policy-based access control. WSO2 App Manager provides Web application resource authorization facility with the use of XACML policies associated with resources.

Defining the XACML policy conditions

Follow the below steps to define the conditions of a XACML-based entitlement policy.

1. Log in to the admin dashboard of WSO2 App Manager using admin/admin credentials and the following URL: https://localhost:9443/admin-dashboard
2. Click Entitlement Policies, and then click Add New.
3. Enter a name for the entitlement policy.
4. Enter a description for the entitlement policy.

5.  Define the conditions of the entitlement policy in the provided editor as shown below.

   For more information on defining XACML policies, see OASIS XACML Version 3.0 documentation.

   

6. Select Permit or Deny under Effect section to create a new resource policy by enabling the defined XACML policy. If you select Permit, the user will be permitted to access, and if you select Deny, the Web app resource access will be denied.
7. Click Validate to check the validity of the policy. It checks for syntax errors and verifies whether the condition adheres to XACML policy language specifications. 

8. Click Save to save the policy condition details. 

   Only the author of the policy can edit shared policies.

9. Click Entitlement Policies in the left menu, and then click View All. You view the saved policy under the list of XACML policies as shown below.
   
   You can edit and delete defined XACML policies using the provided buttons under the Action column as shown above.

Associating XACML policies with Web application resources

Follow the steps below to associate the defined XACML policies with the HTTP verbs of the URL Pattern of Web application resources when creating a Web application.

1. In the Step 2 - Policies of creating a Web application, select the Entitlement Policy as shown below.

   

2. Associate the XACML policy defined above to a HTTP Verb of a specific URL Pattern of a Web app resource in Step 3 - Web Application Resources section as shown below.