XACML policies
For its Authorization feature, Talend ESB is using three types of XACML policies: the Role Policies, the Permission Assignment Policies, and the Permission Policies. Their role can be summarized as follows:
-
A PDP receives a request from a PEP, which contains the resource, action, role, date, and some other optional data.
-
The PDP first goes through the Role Policies it has to try to match the given role name.
-
If it finds a match, then it finds the Permission Policies that are referenced via the Permission Assignment Policy associated with the Role Policy.
-
It matches these policies against the request: the resource and the action name.
-
If they all match then the authorization decision is "permit".
Otherwise, it is "deny" or "indeterminate".