Multiple Obligations

[zeno521]

Hi AuthzForce team,

We are working on a POC with Authzforce PDP engine. We have multiple permit rules (each with obligations) in a policy with deny overrides rule combining algorithm. We expected the obligations from all rules to be returned in the results when all the rules and policy return Permit. However, we can only see the obligations returned from the first permit rule.

Could you indicate if this is an expected behaviour please? If it is, how to return the obligations from all the rules?

Your earliest response is highly appreciated!

[cdanger]

Which version of AuthzForce Core are you using?

I tried with these Policy and Request:
Policy.xml.txt
Request.xml.txt

Works for me. I get all obligations from the two Permit Rules in the Result.

[zeno521]

We are using v24.1.0.

We had a try with your sample policy and request, and it returned the obligations from the two Permit rules as expected. However, if we remove the Deny rule (rule 1), it only returned obligations from the first Permit rule. Is that correct behaviour please?

[cdanger]

There is no v24.1.0 for AuthzForce core. Latest release is 21.0.0. Are you sure?

[zeno521]

Sorry, it's 21.4.0.

https://mvnrepository.com/artifact/org.ow2.authzforce/authzforce-ce-core-pdp-api/21.4.0

[cdanger]

OK this is the version of authzforce-ce-core-pdp-api (Core PDP API). But which version of authzforce-ce-core-pdp-cli (if you use the CLI ) or authzforce-ce-core-pdp-engine (if you use the Java API ) do you use?

See the Usage section of the README for more info.

[zeno521]

authzforce-ce-core-pdp-engine-20.3.2.jar

[cdanger]

Bug confirmed. I create the issue #92 .

[zeno521]

Thanks @cdanger! May I know when the fix is expected to be available please?

[cdanger]

Should be fixed now in latest release 21.0.1.

[zeno521]

Awesome! Thank you very much!