Role Based Policy

Role Specification

To support role based authorization in Microservice APIs, a new header parameter named roleId is introduced to enable the role along with the API request.

If the provided roleId contains the authorization to the respective APIs, the appropriate data is fetched and displayed in the response. If not, the following authorization failure message is displayed.

New Rule (LegalEntity.xml) to GET API's added, the Client can filter the records from the database, which expects the header field companyid (Optional) to pass the request.

Single Role Specification

• To provide the role as a string data type in the API request, pass it as follows.



• If the provided roleId matches with your attribute value, it proceeds to fetch the data. Otherwise, it throws authorization failure error.
• During this scenario, to match with the policy-set level targets, you must specify the attribute value in your XACML policy file as follows.

<Target>
    <AnyOf>
        <AllOf>
            <Match
                MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                <AttributeValue
                    DataType="http://www.w3.org/2001/XMLSchema#string">"ADMIN"</AttributeValue>
                <AttributeDesignator
                    AttributeId="urn:oasis:names:tc:xacml:1.0:subject:roleId"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    Category="urn:oasis:names:tc:xacml:3.0:attribute-category:subject"
                    MustBePresent="true" />
            </Match>
        </AllOf>
    </AnyOf>
</Target>

Files for Reference:

• servicerequest-admin-policy.xml
• servicerequest-pdp-config.xml
• servicerequest-legalentity.xml
• root-policy.xml