Writing Authorization Policy Just Got Easier

•
Date Posted: 25 September 2023; •
Author: Andrew Clymer; •
Estimated Reading Time: 4 minute read

With the release of Enforcer 3.0, we have focused on improving the tools you use to create policies and a tweak to the ALFA language to make it even easier to read.

Enhanced IDE Experience

Enforcer 3.0 provides an enhanced developer experience for Visual Studio Code and Visual Studio 2019+. The ALFA compiler has been refactored to provide additional information to allow us to develop better navigation and refactoring tooling. You can download the extensions for your preferred IDE from one of the links below.

Visual Studio Code

Visual Studio

Go to Definition

Navigate from the use of an attribute, policy or policyset to its definition.

Find All References

View or navigate from any symbol (attribute, policy, policyset or function) to all the locations that reference the symbol.

Refactoring

Rename any symbol definition and update all the references so you can quickly refine the names of your policy components to make your policies even easier to read and understand.

Hover

Hover over any function call, attribute or policy usage, and you will get an overview of the symbol definition.

Usage count

Allowing you to quickly see how often a function, attribute or policy is used. A code lens is applied to each symbol definition, indicating the number of references

ALFA Enhancement

ALFA function signatures are defined as follows

function SubString = "urn:oasis:names:tc:xacml:3.0:function:string-substring": 
string integer integer -> string

While this provides all the information necessary for the ALFA compile to check the call site for the function is correct, it does not assist the developer writing the call to know the purpose for each argument ( string integer integer). As of Enforcer 3.0, we have enhanced the ALFA function declaration to include named arguments.

function SubString = "urn:oasis:names:tc:xacml:3.0:function:string-substring":
source: string start:integer length:integer -> string

Adding a name for the argument now makes the purpose of each argument clear. Further, IDE tooling provides this information when you hover over a function call site.

Writing and maintaining ALFA now got a load simpler. The IDE tools' next release will provide auto-complete, so there will be no need to remember the various combining algorithms or what attributes are in scope.

authorization

Andrew Clymer

•
Job Role: Head of Identity and Access Management; •
Company: Rock Solid Knowledge

Andrew is a Director at Rock Solid Knowledge.