Secure a Java REST API by checking each protected request at a policy enforcement point (PEP), sending a standards-based XACML JSON request to a policy decision point (PDP), and translating the PDP’s decision into explicit API behavior. Use ALFA to author policies only if the selected ALFA compiler produces policies compatible with your PDP; ALFA is not the runtime JSON authorization protocol.
How the authorization flow works
The authorization boundary sits between the REST request and the protected operation:
- REST client/API: The client requests an operation on a protected resource.
- PEP: Code in the Java request path authenticates the caller, gathers trusted attributes, and decides whether to ask for an authorization decision.
- XACML JSON request: The PEP expresses the subject, requested action, resource, and relevant attributes in the JSON Profile format.
- PDP: The policy decision point evaluates the request against its loaded XACML policies.
- XACML JSON response: The PDP returns a policy decision using XACML response semantics.
- API authorization result: The PEP enforces the decision before the API performs the requested operation.
The OASIS JSON Profile of XACML 3.0 Version 1.1 defines the PEP-to-PDP JSON interface while retaining XACML core request and response semantics. OASIS approved it on 20 June 2019. The separate XACML REST Profile Version 1.1 defines RESTful authorization resources and requires HTTP transport; OASIS approved that profile on 20 June 2019 as well.
“Defines a standardized interface between a policy enforcement point and a policy decision point using JSON.”
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.— OASIS JSON Profile of XACML 3.0 Version 1.1
“This specification defines a profile for the use of XACML in a RESTful architecture.”
— OASIS XACML REST Profile 1.1
In the REST profile, a PDP resource accepts an XACML request through POST and returns an XACML response. The profile specifies HTTP outcomes including 200, 400, 401, 403, 406, 415, and 5xx. Treat the HTTP status as transport or protocol information; the XACML response carries the authorization decision. Do not infer a Permit merely because the PDP endpoint returned a successful HTTP status.
Put the PEP at the Java API boundary
The PEP should run before the protected operation, close to the code that can enforce the result. Depending on the Java stack, it can be implemented in a request filter, interceptor, controller/service boundary, or a dedicated authorization component. The specific integration depends on the framework and the chosen library; neither profile dictates a particular Java framework.
Rank #2
For each authorization check, define the protected action and resource consistently, then supply the subject and only trusted attributes needed by policy. Stable attribute identifiers and correct datatypes matter: mismatches between the request and policy can produce a result other than the Permit your application expects. Establish where each attribute comes from, how it is validated, and how stale values are handled.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Keep the PEP responsible for enforcement, not policy interpretation scattered throughout controllers. A policy decision that is not Permit must not fall through to the protected operation. Make explicit handling for all four XACML decision outcomes:
- Permit: Continue only when the response and any applicable obligations can be safely honored.
- Deny: Reject the operation.
- NotApplicable: No applicable policy produced a decision for this request; define a safe, explicit outcome rather than treating it as approval.
- Indeterminate: The PDP could not determine a reliable decision; fail safely and record enough diagnostic context for investigation.
Test obligations and advice as part of enforcement. Do not silently ignore information returned with a decision if the policy design relies on the application to act on it.
Secure the PDP connection and separate HTTP failures
Send PEP-to-PDP traffic over TLS. The REST Profile recommends SSL/TLS and requires each implementation to document how it authenticates requests. It explicitly says basic authentication must not be used because it sends passwords in plain text; it identifies OAuth, OpenID, SAML, and SASL as examples of other approaches. Select and document an authentication mechanism appropriate to the deployment rather than assuming that the profile chooses one for you.
Keep policy administration, the PDP service, and the application’s caller-facing API as separately secured surfaces. Restrict who can change policy and who can invoke the PDP. A well-secured public API does not compensate for an exposed policy endpoint or administrative interface.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsUse HTTP authentication and authorization statuses consistently at the API boundary: return 401 Unauthorized when the caller has not authenticated successfully, and 403 Forbidden when an authenticated caller is not authorized for the requested operation. The REST Profile also recommends omitting links to resources the caller is not allowed to access, which can reduce unnecessary disclosure in API responses.
Rank #4
The profile lists 400, 406, 415, and 5xx among its status outcomes, but an application should define how it handles these transport and request failures. For example, malformed or unsupported authorization requests should not be converted into a Permit. Distinguish an API caller’s authentication failure from an unavailable or unusable PDP response, and choose an explicit safe behavior for the latter.
Choose a Java PDP implementation
The available options differ in what their project or product documentation establishes. Validate conformance, deployment fit, runtime support, and operational maintenance against the exact versions you plan to deploy; a library’s general XACML support alone does not establish that every profile or integration feature is supported.
| Option | Documented fit | What to verify |
|---|---|---|
| WSO2 Balana | Open-source Java implementation based on Sun’s XACML implementation. Project documentation lists XACML 3.0, 2.0, 1.1, and 1.0 support. | Release maintenance, Java runtime compatibility, JSON Profile and REST Profile needs, and whether to embed it or run it as a service. |
| Xacml4J | Java implementation for XACML 2.0 and 3.0. Maven Central lists an aggregate artifact and separate xacml-core and xacml-json modules, with version 1.4.0 shown in the registry. The project repository describes REST API support, JSON Profile support, and a PEP annotation API. |
Confirm the listed release’s maintenance status, Java runtime and framework compatibility, deployment model, and the exact profile behavior required by your API. |
| Oracle Platform Security Services | Oracle documents an enterprise authorization REST API based on the XACML 3.0 REST Profile and shows JSON request usage. | Assess fit for a managed or platform-integrated deployment. Do not assume its APIs or operational model match Balana or Xacml4J. |
For an engineering decision, compare the same criteria across candidates: XACML 3.0 conformance; JSON and REST Profile support; ALFA compilation workflow; embedded versus service deployment; Java runtime and framework compatibility; policy and attribute administration; decision latency and caching; auditability; maintenance activity; and licensing or support arrangements. The cited project and product descriptions do not establish comparable latency benchmarks, support terms, or a universal compatibility matrix.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
Use ALFA before runtime, not instead of XACML JSON
ALFA belongs in the policy-authoring and build workflow. The intended sequence is to author a policy, compile or transform it into an XACML 3.0 policy, load that policy into the PDP, and then send runtime authorization requests using the JSON Profile. The runtime PEP-to-PDP request is still XACML JSON; ALFA is not a replacement wire format for that exchange.
ALFA compiler syntax, release status, and Java compatibility depend on the selected tool. No authoritative ALFA language specification or current compiler release details are established here, so do not assume a syntax version or compiler command. Before release, verify the selected vendor’s current documentation and test that its generated policy is accepted and evaluated as intended by the exact PDP version in use.
Implement and test the authorization path
- Model access: List the API actions and resources to protect, the relevant subjects, and the attributes each policy decision needs.
- Establish trust: Authenticate the caller before authorization and identify the trusted source for every attribute included in a request.
- Place enforcement: Put the PEP in the Java request path before protected work occurs.
- Build the request: Create XACML 3.0 JSON requests with stable attribute identifiers and correct datatypes.
- Call the PDP: POST each request to the PDP REST resource over TLS using the documented non-basic authentication method.
- Enforce the response: Handle Permit, Deny, NotApplicable, and Indeterminate explicitly, including any obligations or advice relevant to the application.
- Map caller outcomes: Return 401 for missing or invalid authentication and 403 for an authenticated denial. Define separately how the API responds when the PDP cannot be reached or returns an unusable response.
- Protect administration: Secure policy administration and policy decision services independently.
- Verify edge cases: Test missing attributes, unexpected datatypes, unmatched policies, evaluation failures, obligations and advice, HTTP errors, and service outages in the selected Java stack.
- Check the build chain: Verify ALFA compiler output against the exact PDP version and policies before deployment.
Make authorization decisions auditable
Decide what must be recorded before implementation. Where an audit trail is required, the REST Profile says it must be at least tamper-evident. The profile also points to signed XACML request and response mechanisms for non-repudiation. Design logs to support review of the request, decision, policy context, and enforcement result while protecting sensitive attributes and credentials; avoid recording secrets simply because they appear in an authorization payload.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
