search

wso2 / docs-is

Apache License 2.0
63 stars 306 forks source link

[Doc] Purpose of XACML is unclear in "Try out the UMA flow" #1939

Open rksk opened 5 years ago

rksk commented 5 years ago

In the doc [1] [2], "Try out the UMA flow" > "Publish a policy" it asks to publish an XACML policy, but the purpose of that XACML policy is unclear. A line of intro will help to understand what is happening here.

[1] https://docs.wso2.com/display/IS580/User+Managed+Access+with+WSO2+Identity+Server#UserManagedAccesswithWSO2IdentityServer-Publishapolicy [2] https://docs.wso2.com/display/IS570/User+Managed+Access+with+WSO2+Identity+Server#UserManagedAccesswithWSO2IdentityServer-Publishapolicy

dewniMW commented 5 years ago

@YvonneW Shall we add this? "Subsequent to successful resource registration, the resource owner can set policies at the authorization server. These policies are executed by WSO2 Identity Server in the process of issuing access tokens. The process of setting policy conditions are outside the scope of the UMA 2.0 specification. With WSO2 Identity Server, XACML which is an XML-based language for access control is used. The policy given below is written against the unique resource id generated during the resource registration."