How can I use policy references in ALFA?

This article was originally published on October 10, 2016 and was updated on October 16, 2023.

Abbreviated Language for Authorization (ALFA) is a domain specific language used to express extensible access control markup language (XACML) authorization policies.

However, ALFA is much easier to work with than writing the raw extensible markup language (XML). Depending on who you ask it is also easier to understand and work with than UI tools.

Currently there is only one way to write an ALFA policy and that is to use the ALFA plug-in for Eclipse.

Let's get into how to define and use policy and policy set references.

Defining a Policy and PolicySet

Below is a defined policy and policy set.

As you'll see, this could essentially be the root policy that is used by a policy decision point (PDP).

namespace com.axiomatics {
policyset financial{
apply firstApplicable
policy transactions{
apply firstApplicable
}
}
}

The policy and policy set are for demonstration purposes. They don't do anything as there is no target and no rule with a decision is defined.

In the above example the policy named 'transactions' is nested inside of the policy set 'financial'.

From an output perspective, this generates a single XML file in Eclipse when the .alfa file is saved.

The policy in the XML file is the root policy set named 'financial'.

If we open this file we can find the nested 'transactions' policy inside the financial policy set.

Only the 'financial' xml is generated in Eclipse. We cannot visually see the 'transactions' policy unless we open com.axiomatics.financial.xml.

Referencing a Policy and a PolicySet

Similar to programming where a method can be defined centrally and called many times to execute the same code, a policy set or a policy can be referenced several times from multiple locations.

To achieve this, the ALFA code from the previous example would look like this.

namespace com.axiomatics {
  policyset financial{
    apply firstApplicable
transaction
}
policy transaction{
apply firstApplicable
}
}

The difference is that the policy 'transactions' has been defined outside of the policy set 'financial' and is referenced by its name in one single line inside of the policy set 'financial'.

The output in Eclipse is that policy 'transactions' now generates its own XACML artifact in a separate XML file. We end up with both the 'financial' and the 'transactions' XML files and within the 'financial' policy file the separate 'transactions' policy is referenced.

The 'transactions' policy can also be referenced from other policy sets. Here is an example from a policy set named 'insurance'.

namespace com.axiomatics {
  policyset financial{
    apply firstApplicable
transaction
}

policyset insurance{
apply firstApplicable

transaction
}

policy transaction{
apply firstApplicable
}
}

It is possible to reference a policy set in the same way that the policy itself is referenced above.

Policy references can be very useful when the same policy or policy set is needed in multiple places. The policy or policy set can then simply be referenced similar to how a method is called in other programming languages.

When the reference calls that specific policy or policy set it will be entered by the PDP when iterating through the entire policy to evaluate an authorization request.

Request a demo with our solution experts to dig deeper into how our solution helps you address complex policy management needs.