Partial policy evaluation
Some embodiments provide a method for evaluating a policy for authorizing an API (Application Programming Interface) call to an application. Based on a first set of parameters available before receiving the API call, the method evaluates only a portion of the policy to produce a partially evaluated policy. The method stores the partially evaluated policy in a cache. The method then receives an API call to authorize, and determines whether the API call should be authorized by fully evaluating the policy, using the partially evaluated policy retrieved from the cache first storage, and a second set of parameters associated with the API call. The method responds to the API call with a policy decision based on the fully evaluated authorization policy.
1. A method for evaluating a policy for authorizing an API (Application Programming Interface) call to an application, the method comprising:
based on a first set of parameters available before receiving the API call, evaluating only a first portion of the policy to produce a partially evaluated policy;
storing the partially evaluated policy in a cache first storage;
receiving an API call to authorize;
fully evaluating the policy using (1) the partially evaluated policy retrieved from the cache first storage and (2) a second portion of the policy not previously evaluated to produce the partially evaluated policy; and
responding to the API call with a policy decision based on the full evaluation of the policy.
2. The method of claim 1 , wherein the first set of parameters is associated with the API call.
3. The method of claim 1 , wherein the second portion is evaluated based on a second set of parameters identified after receiving the API call.
4. The method of claim 3 , wherein the second set of parameters includes at least one parameter received with the API call.
5. The method of claim 3 , wherein the second set of parameters includes at least one parameter retrieved from a second storage after receiving the API call.
6. The method of claim 5 , wherein the at least one parameter is retrieved from the second storage based on a parameter received with the API call.
7. The method of claim 5 , wherein the at least one parameter is retrieved with the partially evaluated policy from the second storage.
8. The method of claim 3 , wherein the API call is a first API call, the method further comprising:
receiving a second API call to authorize;
fully evaluating the policy using (1) the partially evaluated policy retrieved from the cache storage and (2) a third set of parameters associated with the second API call; and
responding to the second API call based on the full evaluation of the policy for the second API call.
9. The method of claim 1 , wherein the policy is a role-based access control (RBAC) policy.
10. The method of claim 1 , wherein the first portion of the policy comprises one or more computationally expensive operations.
11. A non-transitory machine readable medium storing a program executing on at least one processing unit of a computer, the program for evaluating a policy for authorizing an API (Application Programming Interface) call to an application, the program comprising sets of instructions for:
based on a first set of parameters available before receiving the API call, evaluating only a first portion of the policy to produce a partially evaluated policy;
storing the partially evaluated policy in a cache first storage;
receiving an API call to authorize;
fully evaluating the policy using (1) the partially evaluated policy retrieved from the cache first storage and (2) a second portion of the policy not previously evaluated to produce the partially evaluated policy; and
responding to the API call with a policy decision based on the full evaluation of the policy.
12. The non-transitory machine readable medium of claim 11 , wherein the first set of parameters is associated with the API call.
13. The non-transitory machine readable medium of claim 11 , wherein the second portion is evaluated based on a second set of parameters identified after receiving the API call.
14. The non-transitory machine readable medium of claim 13 , wherein the second set of parameters includes at least one parameter received with the API call.
15. The non-transitory machine readable medium of claim 13 , wherein the second set of parameters includes at least one parameter retrieved from a second storage after receiving the API call.
16. The non-transitory machine readable medium of claim 15 , wherein the at least one parameter is retrieved from the second storage based on a parameter received with the API call.
17. The non-transitory machine readable medium of claim 15 , wherein the at least one parameter is retrieved with the partially evaluated policy from the second storage.
18. The non-transitory machine readable medium of claim 13 , wherein the API call is a first API call, the program further comprising sets of instructions for:
receiving a second API call to authorize;
fully evaluating the policy using (1) the partially evaluated policy retrieved from the cache storage and (2) a third set of parameters associated with the second API call; and
responding to the second API call based on the full evaluation of the policy for the second API call.
19. The non-transitory machine readable medium of claim 11 , wherein the policy is a role-based access control (RBAC) policy.
20. The non-transitory machine readable medium of claim 11 , wherein the first portion of the policy comprises one or more computationally expensive operations.