AuthzForce RESTful PDP server providing OpenID AuthZEN Access Evaluation API support

This is based on AuthzForce RESTful PDP with extensions to support OpenID AuthZEN API.

In particular, the project provides the following (Maven groupId:artifactId):

• org.ow2.authzforce:authzforce-authzen-pdp-server: a fully executable RESTful PDP server (runnable from the command-line), packaged as a Spring Boot application or Docker image (see the Docker Compose example for usage) providing AuthZEN API.
• org.ow2.authzforce:authzforce-authzen-pdp-extensions: PDP extensions that can be plugged into AuthzForce Core PDP engine to support AuthZEN JSON payloads (like XACML/JSON Profile's payloads), and that are used in the RESTful PDP server.

(First release planned in June 2024!) Go to the releases page for specific release info: downloads (Linux packages), Docker image, release notes

System requirements

Java (JRE) 17 or later.

Versions

See the change log following the Keep a CHANGELOG conventions.

License

See the license file.

Getting started

Launch the PDP with either Docker or the executable JAR as described in the next sections.

Using Docker

Git clone this github repository or download the Source code ZIP from the latest release (First release planned in June 2024!) and unzip it, then from the git clone / unzipped folder, go to the docker directory.

If you wish to use a different XACML Policy from the default, make sure your policy file is in the pdp/conf/policies folder and set the rootPolicyRef to that policy ID in the PDP configuration file pdp/conf/pdp.xml.

Then run: docker compose up -d, then docker compose logs to check the PDP is up and running.

(You can change the logging verbosity by modifying the Logback configuration file pdp/conf/logback.xml.)

Using the executable JAR

Get the latest release's (First release planned in June 2024!) executable JAR from Maven Central with groupId/artifactId = org.ow2.authzforce/authzforce-authzen-pdp-server; or build it from the source by running mvn install (the JAR will be located in pdp-server/target folder). The name of the JAR is authzforce-authzen-pdp-server-M.m.p.jar (replace M.m.p with the latest version).

Make sure it is executable (replace M.m.p with the current version):

chmod u+x authzforce-authzen-pdp-server-M.m.p.jar

Copy the content of that folder to the same directory.

If you wish to use a different XACML Policy from the default, make sure your policy file is in the policies folder and set the rootPolicyRef to that policy ID in the PDP configuration file pdp.xml.

Then run the executable from that directory as follows (replace M.m.p with the current version):

$ ./authzforce-authzen-pdp-server-M.m.p.jar

If it refuses to start because the TCP listening port is already used (by some other server on the system), you can change that port in file application.yml copied previously: uncomment and change server.port property value to something else (default is 8080).

You know the embedded server is up and running when you see something like this (if and only if the logger for Spring classes is at least in INFO level, according to Logback configuration file mentioned down below) :

... Tomcat started on port(s): 8080 (http)

(You can change the logging verbosity by modifying the Logback configuration file logback.xml copied previously.)

Send a request to the PDP

Once the PDP is up and running, you can make a request from a different terminal, for example using a request from one of folders in AuthZEN Interop test directory (install curl tool if you don't have it already on your system):

$ curl --include --header "Content-Type: application/json" --data @/path/to/request.json http://localhost:8080/access/v1/evaluation

Add --verbose option for more details. You should get a JSON response such as:

{"decision": true}

Extensions

If you are missing features in AuthzForce, you can extend it with various types of plugins (without changing the existing code) the same way you do for the RESTful PDP, so please refer to the RESTful PDP project's README for the instructions.

Vulnerability reporting

If you want to report a vulnerability, please follow the GitHub procedure for private vulnerability reporting.

Support

If you are experiencing any issue with this project except for vulnerabilities mentioned previously, please report it on the GitHub Issue Tracker. Please include as much information as possible; the more we know, the better the chance of a quicker resolution:

• Software version
• Platform (OS and JDK)
• Stack traces generally really help! If in doubt include the whole thing; often exceptions get wrapped in other exceptions and the exception right near the bottom explains the actual error, not the first few lines at the top. It's very easy for us to skim-read past unnecessary parts of a stack trace.
• Log output can be useful too; sometimes enabling DEBUG logging can help;
• Your code & configuration files are often useful.

If you wish to contact the developers for other reasons, use AuthzForce contact mailing list.

Contributing

See CONTRIBUTING.md.