The XACML decision model
How the PDP, PAP, PRP, PIP, context handler and PEP work together in Altinn Authorization.
Altinn Authorization bases its decision model on the separation of responsibilities in XACML. The model separates policy administration, retrieval of decision data, decision-making and enforcement.
Components in an authorisation decision
| Role | Responsibility | Detailed reference |
|---|---|---|
| PDP (Policy Decision Point) | Evaluates the request and returns a decision. | How the PDP is constructed. |
| PAP (Policy Administration Point) | Creates and manages authorisation policies. | How policies are administered. |
| PRP (Policy Retrieval Point) | Retrieves the policy that applies to the resource. | How the PRP retrieves policies. |
| PIP (Policy Information Point) | Supplies information about the subject, resource and context. | How the PIP supplies decision data. |
| Context handler | Collects and normalises the information required by the PDP. | How the context handler processes the request. |
| PEP (Policy Enforcement Point) | Enforces the decision at the protected service. | How the PEP enforces the decision. |
Location in the system documentation
System architecture shows the system-level boundaries. Application architecture for Authorization describes the application that performs the PDP function. The pages linked in the table remain the detailed reference for the XACML roles and retain their previous addresses.