Authorization rules evaluator

The authorization rules evaluator takes the rule policy that is attached to the target protected object and evaluates the rule by calling the XSL processor. The input XML document for the transformation contains a definition for how the authorization engine can retrieve one of the following sources for the ADI:

• User credential entitlements that request the authorization
• Application context information that is passed in by the access decision call (passed in by the resource manager)
• Security Verify Access authorization engine context
• Dynamic ADI retrieval entitlement services

The authorization engine expects the rules evaluation to result in the return of one of the string identifiers as shown in Table 1. These identifiers ensure uniqueness when an XSL rule is written incorrectly and the evaluation returns incorrect information. Delimiting the identifiers with an exclamation point (!) enables the evaluator to identify errant cases. The identifiers must be the only text in the output document, although they can be surrounded by white space. A value other than the defined valid values or an empty document might be returned. In this case, the access decision fails and an error code is returned to the resource manager to indicate that the rule is not compliant. The format of an authorization rule is outlined in Format and constraints of rules.