Application construction components - Altinn Authorization
Altinn Authorization is constructed as serveral components.
When defining the authorization components, we used the XACML reference architecture.
Conceptual components
We have defined the following conceptual components/functional areas from the reference architecture.
PDP - Policy Decision Point
The policy decision point is responsible for deciding if an authorization request is authorized or not. It bases its decision on rules and information it has of the resource and the user/system trying to access and perform an operation on a resource.
PAP - Policy Administration Point
Responsible for defining and administering authorization policies.
In Altinn Authorization, there are the following components that function as a PAP
- Altinn Studio to define rules for Apps
- Altinn Access Management for defining delegated rules
- Altinn Resource Registry allows the administration of resource policies.
PRP - Policy Retrieval Point
The Policy Retrieval Point is responsible for finding the right policy.
In Altinn, there are two sources of Policies. Altinn Access Management for delegated policies and Altinn Resource Registry
Context Handler - In production
Responsible for enriching the decision request so authorization correctly can be evaluated. Read more
PIP - Policy information point - In production
Responsible for providing information about the subject and the resource to the context handler.
PEP - Policy Enforcement Point - In Pro
Responsible for enforcing the decision from PDP. PEP is the component that blocks a request or lets it through.
For a functional description see details in application solution components.
Construction diagram Authorization
- Application construction components - Altinn Access Control
The Access Control component in the Altinn platform is an asp.net core 6 web API application deployed as a docker container to the Altinn Platform Kubernetes cluster.
- Application construction components - Altinn Access Groups
The Access Group component in Altinn platform is constructed as an asp.net core 6 web API application deployed as a docker container to a Kubernetes cluster.
- Application construction components - Altinn Access Management
The Access Management component in the Altinn platform is an asp.net core 6 web API application with a REACT frontend deployed as a docker container to the Altinn Platform Kubernetes cluster.
- Register
The Register micro service gives register information to Apps.
- Application construction components - Altinn Resource Registry
The Resource Registry component in Altinn platform is constructed as an asp.net core 6 web API application deployed as a docker container to a Kubernetes cluster.