The Entitlement Mediator intercepts requests and evaluates the actions performed by a user against an eXtensible Access Control Markup Language (XACML) policy. WSO2 Identity Server can be used as the XACML Policy Decision Point (PDP) where the policy is set, and the ESB profile of WSO2 EI serves as the XACML Policy Enforcement Point (PEP) where the policy is enforced.
The following are descriptions for the four sub elements of the Entitlement mediator.
|OnAccept||The sequence to execute when the result returned by the Entitlement mediator is |
|OnReject||The sequence to execute when the result returned by the Entitlement mediator is |
|Obligations||The sequence to execute when the XACML response contains an obligation statement. When this response is received, the Entitlement mediator clones the current message context, creates a new message context, adds the obligation statement to the SOAP body and then executes the sequence. Since the Obligations sequence is executed synchronously, the Entitlement mediator waits for a response. If the sequence returns a |
|Advice||The sequence to execute when the XACML response contains an advice statement. When this response is received, the Entitlement mediator clones the current message context, creates a new message context, adds the advice statement to the SOAP body and then executes the sequence. Since the Advice sequence is executed asynchronously, the Entitlement mediator does not wait for a response.|
The Entitlement mediator configuration screen appears below the tree as shown below.
The parameters available for configuring the Entitlement mediator are as follows.
|Entitlement Server||Server URL of the WSO2 Identity Server that acts as the PDP (e.g., ).|
|User Name||This user should have permissions to log in and manage configurations in the WSO2 Identity Server.|
|Password||The password of the username entered in the User Name parameter.|
|Entitlement Callback Handler|
The handler that should be used to get the subject (user name) for the XACML request.
|Entitlement Service Client|
The method of communication to use between the PEP and the PDP. For SOAP, choose whether to use Basic Authentication (available with WSO2 Identify Server 4.0.0 and later) OR the AuthenticationAdmin service, which authenticates with the Entitlement service in Identity Server 3.2.3 and earlier. Thrift uses its own authentication service over TCP. WS-XACML uses Basic Authentication.
|Thrift Host||The host used to establish a Thrift connection with the Entitlement service when the Entitlement Service Client is set to Thrift.|
|Thrift Port||The port used to establish a Thrift connection with the Entitlement service when the Entitlement Service Client is set to Thrift. The default port is 10500.|
You will now define the sequences you want to run for the entitlement results.
You can also configure the Mediator using XML. Click switch to source view in the Mediator window.
In the following example, the WSO2 Identity Server (with log in URLis see to authenticate the user invoking the secured backend service.