Authorizer

Before processing a request, the Liberty Personal Profile Service will verify the authorization of the WSC making the request. There are two levels of authorization check that can be done:

1. Is the requesting entity authorized to access the requested resource profile information?

2. Is the requested resource published to the requestor?

Authorization occurs via a plug-in to the Liberty Personal Profile Service: an implementation of the com.sun.identity.liberty.ws.interfaces.Authorizer interface. Although a new implementation can be developed, OpenSSO provides the default: com.sun.identity.liberty.ws.idpp.plugin.IDPPAuthorizer. This plug-in defines four policy action values for the query and modify operations:

• Allow

• Deny

• Interact For Consent

• Interact For Value

The resource values for the rules are similar to x-path expressions defined by the Liberty Personal Profile Service.

Authorization can be turned off by deselecting one or both of the following attributes also defined in the Liberty Personal Profile Service:

• Require Query PolicyEval:

• Require Modify PolicyEval: