This repository is the entry point to start with Attribute Base Access Control (ABAC) and Policy-as-code from Axiomatics.
Online documentation from Axiomatics is available at https://docs.axiomatics.com/policy-testing-framework/
ALFA introduction available at https://axiomatics.github.io/alfa-vscode-doc/docs/alfa-introduction/introduction/
- Add the Axiomatics repository access keys, that you received from Axiomatics, in file
gradle.properties - Make sure your IDE, such as IntelliJ or Visual Studio Code has the necessary plugins for Java and Gradle projects
- Open this project in your IDE, it contains a sample project
- Execute gradle task
testto test your policies and attribute connectors - Execute gradle task
buildAuthzDomainto build the authorization domain into filebuild/alfa/domain/ads/domain.yaml - Copy Axiomatics ADS license, that you received from Axiomatics, to
license/directory - Execute gradle task
runAdsto start the Access Decision Service locally - Execute
buildAdsDockerImageto build a docker image to the local docker registry
A simple policy example allowing all consultants to access resources in their own location.
namespace acme {
policyset Main {
apply firstApplicable
consultants.Main
}
}
namespace consultants {
policy Main {
target
clause user.role == "consultant"
apply firstApplicable
rule permitIfLocationsMatch {
permit
condition user.location == resource.location
}
}
}A simple example test that verifies Cecilia can access resource 1. This test is a system tests so it assumes test PIP data that Cecilia is a consultant and located in the same location as resource 1.
public class MySystemTest {
@RegisterExtension
public AlfaExtension alfa = new AlfaExtension().withAttributeConnectors();
@Test
public void shouldGiveCeciliaAccessToResource1() {
TestRequest target = alfa.newTestRequest()
.with("user.identity", "cecilia")
.with("resource.identity", "1");
TestResponse result = target.evaluate();
assertThat(result, is(permit()));
}
}After test run, a visualization trace can be produced. It shows how the policy was evaluated and which attributes were fetched from PIPs. This gives an overview of the policy or when detail mode is enabled, evaluation result of any function is shown to support debugging. Note that test trace visualisation is currently released in as a preview feature and is not covered by SLA.
Feel free to contact us at https://www.axiomatics.com if you have any questions