On this page:

Required Dependencies

The HERAS-AF XACML Core component needs the following direct dependencies (and their sub-dependencies) to run

com.sun.xml.bind:jaxb-xjc:2.1.12
- com.sun.xml.bind:jaxb-api:2.1
- com.sun.xml.bind:jaxb-impl:2.1.12
- javax.xml.stream:stax-api:1.0-2
- javax.activation:activation:1.1
org.slf4j:slf4j-api:1.5.8
A logging implementation for SLF4J. See Logging configuration for a configuration guide.

Using Maven2 it is very easy to obtain the HERAS-AF dependencies by adding the following repository to your Maven2 pom.xml:

Creating a simple PDP

For the creation of a simple PDP the SimplePDPFactory is provided. By calling the Method getSimplePDP() the factory returns a simple PDP instance.

By default the PDP is initialized with the default set of XACML Functions, DataTypes and CombiningAlgorithms that are provided/implemented by HERAS-AF. Additionally a default configuration for the JAXB Marshallers (formatted output, ...) is loaded.

In cases where it is required to use custom implementations of the combining algorithm, policy repository and/or the PIP, different variants of the method getSimplePDP(...) are provided in the SimplePDPFactory. The following code snippet shows how such issues can be solved.

Custom Initializers

If it is required to use custom initializers these can be provided to the factory.

Deployment of policies

The following code snippet shows how policies can be deployed on the policy repository.

When an ordered combining algorithm is used, the policies can be deployed by additionally specifying their position. The following code snippet shows how this can be done.

Undeployment of policies

The following code snippet shows how policies can be undeployed on the policy repository.

Evaluating a request

On the following code snippet a request is evaluated and the response from the PDP is retrieved.

Marshalling policies / requests / responses

A policy can be marshalled to different targets.

In order to be able to parse an XACML Policy or Request it is necessary to initialize the JAXB subsystem first. This is done by initializing a PDP. Please see "Creating a PDP" above. In the future we will decouple the JAXB initialization, so that the Policy and Request marshalling/unmarshalling operations can be used without initializing the PDP. See also: HERASAFXACMLCORE-98

The following list describes the possible marshalling targets:

OutputStream (java.io)
File (java.io)
Result (javax.xml.transform)
ContentHandler (org.xml.sax)
Writer (java.io)
Node (org.w3c.dom)
XMLStreamWriter (javax.xml.stream)
XMLEventWriter (javax.xml.stream)

The code snippet below shows how a policy is marshalled to an OutputStream.

For the marshalling of requests and responses the same repertoire of targets is available. A response or a request, respectively, can be marshalled to an OutputStrem, a File, Writer, and so on. The code example below shows how a request is marshalled to an OutputStream (the marshalling of a response is equal).

For the unmarshalling of policies, requests and responses the PolicyConverter, RequestCtxFactory and ResponseCtxFactory are provided. The following list describes the possible input types for the unmarshalling:

File (java.io)
InputStream (java.io)
Reader (java.io)
URL (java.net)
InputSource (org.xml.sax)
Node (org.w3c.com)
Source (javax.xml.transform)
XMLStreamReader (javax.xml.stream)
XMLEventReader (javax.xml.stream)

The code example below shows how an InputStream is unmarshalled to a RequestCtx. The usage of the ResponseCtxFactory and the PolicyConverter ist equal to RequestCtxFactory.

Configuration of Logging MDC

MDC (Mapped Diagnostic Context) is an intstrument for distinguishing interleaved log output from different sources. Interleaved log output appears typically in cases where a server handles multiple client requests nearly simultaneous.

The following keys are used in the configuration:

org:herasaf:request:xacml:evaluation:requesttime
Timestamp of the request arrival. Used to identify the incoming request.

org:herasaf:xacml:evaluation:evaluatableid
The id of the Evaluatable.

org:herasaf:xacml:evaluation:ruleid
The id of the Rule

The code below shows an example configuration using LogBack:

GettingStarted