how to distribute PEP and PDP in XACML as a service call

Question

I am using WSO2 Balana XACML 3.0. I want to distribute my PEP and PDP as a service so that I can host multiple instances of PEP and PDP on the virtual machine. What is the best way to achieve this and how can I handle multiple PEP and PDP?

Answer 1

I guess, you want to separate out the PDP functions as web service API. Then multiple PEP can call one PDP (or cluster of PDP)? Balana is an java library that implement XACML specification. If you need to expose its functions as an web service API, you want to deploy this library in a service hosting server as as Axis2. You can use Axis2 clustering to communicate with multiple servers (cluster). Further more, WSO2 Identity Server is also using Balana library, and It has exposed PDP function as web service API. If you are thinking about the performance, HA, clustering and so on, It is better to use WSO2 Identity Server rather than the Balana library. Because it contains all feature that is needed for production step. (WSO2 Identity Server also an opensource server that you can use freely). However, It is not required to use WSO2IS. You can use Balana. As i mentioned you may need to do some modifications to use it as a web service API and to use it in a production. To get more understand, I could point to the source code to see how Balana library has been used by WSO2 Identity Server. Please check here. Identity Server creates an Balana instance for evaluating XACML requests. Same as you can use Balana library with any platform that you prefer or else you can build your own XACML PDP, modifying it...