Reason codes for rule failures

This feature allows the target application to fail or permit the access request based on the rule failure reason code it is given by the resource manager.

The authorization engine processes all policies for the access decision as normal. If the rule evaluation fails, the engine returns access denied with a reason code in the azn_perminfo_reason_rule_failed permission information attribute list.

When access is denied, the application must check the permission_info attribute list returned from the access decision call. The application determines whether a rule failure reason code was returned from the access decision. The resource manager does not need to check for the attribute on a successful access decision call. The Verify Identity Access application is an example of an aznAPI resource manager that can use the rule failure reason code. When configured, Verify Identity Access forwards the reason code to the protected web application. The protected web application must be mounted through a secure junction to have access to the reason code defined for the authorization rule. The use of rule failure reason codes in Verify Identity Access is limited to the protected object space of junctioned web applications.

The attribute value (the reason code) of the azn_perminfo_reason_rule_failed attribute is a single string. The value is determined and defined by the policy administrator and is set in the rule policy object when it is first created. The only constraint on the value of the reason code is that the value must be a string.