#### Authorizer

Before processing a request, the Liberty Personal Profile Service will verify the authorization of the WSC making the request. There are two levels of authorization check that can be done:

1. Is the requesting entity authorized to access the requested resource profile information?

2. Is the requested resource published to the requestor?

Authorization occurs via a plug-in to the Liberty Personal Profile Service: an implementation of the `com.sun.identity.liberty.ws.interfaces.Authorizer` interface. Although a new implementation can be developed, OpenSSO provides the default: `com.sun.identity.liberty.ws.idpp.plugin.IDPPAuthorizer`. This plug-in defines four policy action values for the query and modify operations:

- Allow

- Deny

- Interact For Consent

- Interact For Value

The resource values for the rules are similar to `x-path` expressions defined by the Liberty Personal Profile Service.

/PP/CommonName/AnalyzedName/FN Query Interact for consent /PP/CommonName/* Modify Interact for value /PP/InformalName Query Deny

Authorization can be turned off by deselecting one or both of the following attributes also defined in the Liberty Personal Profile Service:

- Require Query PolicyEval:

- Require Modify PolicyEval: