Partial policy evaluation
Some embodiments provide a method for evaluating a policy for authorizing an API (Application Programming Interface) call to an application. Based on a first set of parameters available before receiving the API call, the method evaluates only a portion of the policy to produce a partially evaluated policy. The method stores the partially evaluated policy in a cache. The method then receives an API call to authorize, and determines whether the API call should be authorized by fully evaluating the policy, using the partially evaluated policy retrieved from the cache first storage, and a second set of parameters associated with the API call. The method responds to the API call with a policy decision based on the fully evaluated authorization policy.
1. A computer system comprising:
a set of processing units for processing instructions; and
a non-transitory machine readable medium storing a program executing on at least one hardware processing unit of a computing device, the program for evaluating a policy for authorizing an API (Application Programming Interface) call to an application, the program comprising sets of instructions for:
based on a first set of parameters available before receiving the API call, evaluating only a portion of the policy to produce a partially evaluated policy;
storing the partially evaluated policy in a cache storage;
receiving the API call to authorize;
determining whether the API call should be authorized by fully evaluating the policy using (1) the partially evaluated policy retrieved from the cache storage and (2) a second set of parameters associated with the API call; and
responding to the API call with a policy decision based on the fully evaluated policy.
2. The computer system of claim 1 , wherein the first set of parameters is associated with the API call.
3. The computer system of claim 1 , wherein the second set of parameters includes at least one parameter received with the API call.
4. The computer system of claim 1 , wherein the second set of parameters includes at least one parameter identified after receiving the API call.
5. The computer system of claim 4 , wherein the cache storage comprises a first storage and a second storage, wherein the second set of parameters includes at least one parameter retrieved from the second storage after receiving the API call.
6. The computer system of claim 5 , wherein the at least one parameter is retrieved from the second storage based on a parameter received with the API call.
7. The computer system of claim 5 , wherein the at least one parameter is retrieved with the partially evaluated policy from the second storage.
8. The computer system of claim 1 , wherein the API call is a first API call, wherein the policy decision is a first policy decision, the program further comprising sets of instructions for:
receiving a second API call to authorize;
determining whether the second API call should be authorized by fully evaluating the policy using (1) the partially evaluated policy retrieved from the cache storage and (2) a third set of parameters associated with the second API call; and
responding to the second API call with a second policy decision.
9. The computer system of claim 8 , wherein the second policy decision is different from the first policy decision.
10. The computer system of claim 1 , wherein the API call is a first API call, wherein the policy decision is a first policy decision, wherein the partially evaluated policy is a first partially evaluated policy, the program further comprising sets of instructions for:
receiving a second API call to authorize;
based on a third set of parameters received with the API call, evaluating only a portion of the policy to produce a second partially evaluated policy; and
storing the second partially evaluated policy in a cache storage, wherein the set of instructions for storing the second partially evaluated policy in the cache storage comprises a set of instructions for invalidating the first partially evaluated policy.
11. The computer system of claim 1 , wherein the policy is a role-based access control (RBAC) policy.
12. The computer system of claim 1 , wherein the portion of the policy comprises computationally expensive operations.