summaryrefslogtreecommitdiffstats
path: root/docs/drools/guardpdp.rst
diff options
context:
space:
mode:
Diffstat (limited to 'docs/drools/guardpdp.rst')
-rw-r--r--docs/drools/guardpdp.rst30
1 files changed, 15 insertions, 15 deletions
diff --git a/docs/drools/guardpdp.rst b/docs/drools/guardpdp.rst
index 797557fc..0fdb4ab2 100644
--- a/docs/drools/guardpdp.rst
+++ b/docs/drools/guardpdp.rst
@@ -3,23 +3,23 @@
.. http://creativecommons.org/licenses/by/4.0
************************
-Using guard in the PDP-D
+Using guard in the PDP-D
************************
.. contents::
:depth: 2
-This guide will help configure and test guard connection from PDP-D to PDP-X. This guide assumes that the PDP-D is installed and running policy properly with other properties being set properly.
+This guide will help configure and test the guard connection from PDP-D (drools-pdp) to PDP-X (xacml-pdp). This guide assumes that the PDP-D is installed and running policy properly with other properties being set properly.
Configuration
-^^^^^^^^^^^^^
+^^^^^^^^^^^^^
Prerequisites
-------------
Stop Policy, open, and verify the config:
-- Stop policy with *policy stop*
+- Stop policy with **policy stop**
- Open *$POLICY_HOME/config/controlloop.properties.environment*
- Make sure the *sql.db.host*, *sql.db.username* and *sql.db.password* are set correctly
@@ -39,7 +39,7 @@ Guard Properties
**guard.disabled** - For enabling / disabling guard functionality.
- For example, to enable set it to false.
- - When this is set to true, the previous two properties will be ignored.
+ - When this is set to true, the previous two properties (guard.url and guard.jdbc.url) will be ignored.
- If guard is enabled, then the following PDP-X properties must also be set.
@@ -63,16 +63,16 @@ For testing these properties before running policy, see Verification below.
**pdpx.client.password** - Client password
-
Verification
-^^^^^^^^^^^^
+^^^^^^^^^^^^
It is recommended to test using CLI tools before running since changing bash command parameters are faster than restarting policy.
Logs Verification
-----------------
-Checking the logs is straight forward. Check the *$POLICY_HOME/logs/error.log* file for the word "*callRESTfulPDP*" for any exceptions thrown. If they are thrown then there was a problem with the connection.
-You can also check the *$POLICY_HOME/logs/network.log* file for the word "*Indeterminate*" which implies the connection failed or got a non 200 response code.
+Checking the logs is straight forward. Check the **$POLICY_HOME/logs/error.log** file for the word "*callRESTfulPDP*" for any exceptions thrown. If they are thrown then there was a problem with the connection.
+You can also check the **$POLICY_HOME/logs/network.log** file for the word "*Indeterminate*" which implies the connection failed or got a non 200 response code.
+
CLI Verification
----------------
@@ -80,29 +80,29 @@ CLI Verification
It can be helpful to test the PDP-X connection using bash commands to make sure that the PDP-X properties are correct and the guard.url property is correct before running policy.
**Method 1: httpie - CLI, cURL-like tool for humans**
-
+
Using the http command we can make a request directly to PDP-X from the command line. Use the following form:
.. code-block:: bash
-
+
http
POST pdp:8081/pdp/api/getDecision
Authorization:<yourAuth> ClientAuth:<yourClientAuth>
Environment:<environment> Content-Type:application/json < guard_request.json
-
+
| where:
| *<yourAuth>* is the string generated from user:pass converted to base64 encoding
| (a conversion tool is available at https://www.base64encode.org/)
| *<yourClientAuth>* is generated the same way but from the client user and pass.
| *<environment>* is the context of the request. For example: TEST
| *pdp* is the host of the PDP-X
-
+
The guard_request.json should be in the form of the following:
-
+
.. code-block:: json
:caption: guard_request.json
-
+
{
"decisionAttributes": {
"actor": "APPC",