Entitlement Management

This user guide describes various configuration and management options available with entitlement management.

Left hand menu has been separated in to three main management categories. i.e. PAP (Policy Administrator Point), PDP (Policy Decision Policy) and PEP (Policy Enforcement Point)

Figure 1: Entitlement Management

PAP - Policy Administration

Policy Administration Point provides various operations in policy management. Following are the list of them

  1. Create XACML 3.0 based Entitlement Policy using three type of policy editor, i.e Simple, Basic and Standard Policy Editors
  2. Create XACML 3.0 based Entitlement Policy Sets using policy editor
  3. Policy editors are configurable. You can feed attribute ids, categories and data types.
  4. Import XACML based Entitlement Policy - use to import a policy using either via file system or registry.
  5. Write XACML based Entitlement Policy using XML editor
  6. Try out defined policy using XACML 3.0 requests
  7. Update Entitlement Policy using policy editors or XML view
  8. Roll Back Entitlement Policy to older versions
  9. Publish Entitlement Policy to PDP policy store or external policy stores
  10. Delete Entitlement Policy from PAP
  11. View Entitlement Policy Status

The defined policies can be search using the Search Policy option. Here you can provide regular expression of the policy identifier or else some attribute value that is contain in the policy

Figure 2: Policy administration

There are five different ways that you can add policy in to PAP

Figure 3: Select Policy Creation Wizard

Figure 4: Simple Policy Creation Wizard UI

Figure 5: Basic Policy Creation Wizard UI

Figure 6: Standard Policy Creation Wizard UI

Figure 7: Creating a policy set

Figure 8: Import a policy or Policy Set from file system or registry

PAP - Policy Publisher

The defined policy can be published using policy publishers to any Policy store. You can create a policy in PAP and then can publish to registered subscribers. By default, there are two publisher, i.e PDP publisher and Carbon Basic Auth Publisher. There is one registered subscriber for PDP publisher. You can use 'Add Subscriber' to define more subscriber. Subscribers can be search by providing regular expression and You can view the status of subscribers

Figure 9: Publishing a policy

PDP - Policy View

This shows the actual PDP policy store. You can view, order and enable PDP policies from here. Also you can configure the global policy combining algorithm for PDP policies. The defined policies can be search using the Search Policy option. Here you can provide regular expression of the policy identifier

Figure 10: PDP Policy View

PDP Configurations

This editor provides the UI for view the PDP extension points. You can reinitialize extensions, clear decision cache and attribute cache using this UI

Figure 11: PDP extension

PEP - Evaluate Entitlement Policy

You can evaluate the PDP engine using this editor. You can create XACML 3.0 request and do the evaluation.

Figure 12: Evaluate the defined entitlement policy

PEP - Search

This UI can be used to locate defined policy. Following options can be configured in the search query.

  1. Search by - search either by user or role.
  2. User/Role name - name of the user or role.
  3. Subject Id - the id of the policy.
  4. Action - the action of the resource.
  5. Resource - the name of the resource
  6. Enable search through child resources - enable this if you want to search through child resources.

Figure 13: Search

External References: