Search code examples
xacmlabacwso2-identity-server

WSO2 Identity / How to Register XACML PIP Java Extension and its Claims

Scanning through the WSO2 documentation and several blogs, I found three different type of registry mechanisms to add new claims to a Java PIP module:

  1. By use of setup file calledentitlement.properties and by adding of Java static properties for each variable as described in the sample case from the WSO2 manual, see: Writing a Custom Policy Info Point;

  2. By use of supportedAttributesIds.add as described in link How to write a PIP point for WSO2 IS;

  3. By use of a setter method: public Set getSupportedIds() { Set<String> ids = new HashSet<String>(); ids.add("http://kmarket.com/id/role"); return ids; } as described in the Stackoverflow post How To Add User Defined Attribute in PIP Attribute User Store

Please instruct which of the three options is the updated and recommended solution for adding new fields produced by the lookup of external data sources executed by the Balana PIP as an extension of the "AttributeFinderModule" class.

I've also tested the code posted in this example and compiled it with Java 6 JDK, see source reference How To Add User Defined Attribute in PIP Attribute User Store After the restart, the WSO2 server continues to display the following error: 

Error while loading entitlement policies. Exception occurred while trying to invoke service method getAllPolicies
The following error details are available. Please refer logs for more details.
org.apache.axis2.AxisFault: Exception occurred while trying to invoke service method getAllPolicies
at org.wso2.carbon.identity.entitlement.ui.client.EntitlementPolicyAdminServiceClient.handleException(EntitlementPolicyAdminServiceClient.java:478)
at org.wso2.carbon.identity.entitlement.ui.client.EntitlementPolicyAdminServiceClient.getAllPolicies(EntitlementPolicyAdminServiceClient.java:81)
at org.apache.jsp.entitlement.index_jsp._jspService(org.apache.jsp.entitlement.index_jsp:183)

when adding the extended AttributeFinder Java extension. Is this a known bug in the WSO2 server?

Solution

  • I've replaced the KmarketPIPAttributeFinder program module by the latest version from the svn source repository (see link below) and compiled it. This solved the problem under WSO2 Identity Server Version 5 and the routine started to register the PIP attributes, now visible at the PDP extensions.

    Download the latest code from: https://svn.wso2.org/repos/wso2/carbon/platform/trunk/components/identity/org.wso2.carbon.identity.samples.entitlement.pip/src/main/java/org/wso2/carbon/identity/samples/entitlement/pip/KmarketPIPAttributeFinder.java