Product overview · 2 min read
Axiomatics Policy Server overview
Neutral overview. Twobo Technologies is not affiliated with, sponsored by or a reseller for Axiomatics or any other vendor. Product names belong to their owners; check the vendor's own documentation for current editions and licensing.
Short answer
The Axiomatics Policy Server is an attribute-based authorization product built on the XACML standard: policies written in ALFA or XACML are evaluated by a policy decision point that applications and gateways call through enforcement points, with attributes fetched from directories and databases through information points.
Key takeaways
- It follows XACML's PEP, PDP, PIP and PAP architecture.
- Policies can be authored in ALFA, a readable language that maps to XACML.
- Axiomatics positions it within its broader orchestrated authorization offering.
Most applications hard-code their authorization rules. Externalized authorization products move those rules into a central policy engine. Axiomatics, a company founded in Sweden, has long been associated with the XACML standard, and its policy server is a well-known example of the category.
What does the policy server do?
It evaluates authorization requests against attribute-based policies and returns decisions to the applications that ask.
| Component | Role |
|---|---|
| Policy Decision Point (PDP) | Evaluates requests against policies |
| Policy Enforcement Points (PEPs) | SDKs, gateway plugins or data-layer filters that ask and enforce |
| Policy Information Points (PIPs) | Connectors to directories and databases for attributes |
| Policy administration | Authoring, testing and deploying policies |
What does a policy look like?
A rule over subject, resource, action and environment attributes, for example "a doctor may view a patient record if assigned to the patient's ward".
In ALFA, policies read more like code than XML, then compile into XACML 3.0. Requests and responses can use the XACML JSON profile.
When does a policy server make sense?
When rules are complex, change often, apply across many applications, or must be auditable.
Typical drivers are regulated data (finance, health, government), data-level filtering, and consistency across many apps. For simpler needs, roles in the application or a lightweight policy library may be enough. See the authorization guide and the entitlement management overview.
How does it connect with identity standards?
Identity attributes arrive in tokens or assertions; the PEP passes them into the authorization request.
The article on XACML with OpenID Connect, SAML, OAuth and SCIM walks through the full flow. Inspect the claims your PEP will receive with the JWT Decoder.
Questions
What is ALFA?
The Abbreviated Language for Authorization, a compact, programming-style syntax for XACML policies. Axiomatics developed it and proposed it to OASIS; ALFA policies compile into XACML.
What are alternatives?
Other XACML-based products and open-source PDPs, and newer policy engines such as Open Policy Agent, Cedar-based services and relationship-based systems like OpenFGA. The authorization guide compares the models.