Partial policy evaluation
Some embodiments provide a method for evaluating a policy for authorizing an API (Application Programming Interface) call to an application. Based on a first set of parameters available before receiving the API call, the method evaluates only a portion of the policy to produce a partially evaluated policy. The method stores the partially evaluated policy in a cache. The method then receives an API call to authorize, and determines whether the API call should be authorized by fully evaluating the policy, using the partially evaluated policy retrieved from the cache first storage, and a second set of parameters associated with the API call. The method responds to the API call with a policy decision based on the fully evaluated authorization policy.
1 . A method for evaluating a policy for authorizing an API (Application Programming Interface) call to an application, the method comprising:
before receiving the API call, evaluating, based on a first set of available parameters, a portion of the policy to produce a partially evaluated policy;
receiving the API call to authorize;
evaluating an entirety of the policy using (1) the partially evaluated policy, (2) a second set of parameters, and (3) a second portion of the policy not previously evaluated to produce the partially evaluated policy; and
responding to the API call with a policy decision based on evaluating the entirety of the policy.
2 . The method of claim 1 , wherein the first set of parameters is associated with the API call.
3 . The method of claim 1 , wherein the second set of parameters includes at least one parameter received with the API call.
4 . The method of claim 1 , wherein the second set of parameters includes at least one parameter identified after receiving the API call.
5 . The method of claim 4 , wherein the partially evaluated policy is stored in a first storage, wherein the second set of parameters includes at least one parameter retrieved from a second storage after receiving the API call.
6 . The method of claim 5 , wherein the at least one parameter is retrieved from the second storage based on a parameter received with the API call.
7 . The method of claim 5 , wherein the at least one parameter is retrieved from the second storage and the partially evaluated policy is retrieved from the first storage.
8 . The method of claim 1 , wherein the policy is a role-based access control (RBAC) policy.
9 . The method of claim 1 , wherein the portion of the policy is partially evaluated before receiving the API call to reduce computations performed after receiving the API call.
10 . The method of claim 1 , wherein the second set of parameters comprises parameters available after receiving the API call.
11 . A non-transitory machine readable medium storing a program executing on at least one hardware processing unit of a computing device, the program for evaluating a policy for authorizing an API (Application Programming Interface) call to an application, the program comprising sets of instructions for:
before receiving the API call, evaluating, based on a first set of available parameters, a portion of the policy to produce a partially evaluated policy;
receiving the API call to authorize;
evaluating an entirety of the policy using (1) the partially evaluated policy, (2) a second set of parameters available after receiving the API call, and (3) a second portion of the policy not previously evaluated to produce the partially evaluated policy; and
responding to the API call with a policy decision based on evaluating the entirety of the policy.
12 . The non-transitory machine readable medium of claim 11 , wherein the first set of parameters is associated with the API call.
13 . The non-transitory machine readable medium of claim 11 , wherein the second set of parameters includes at least one parameter received with the API call.
14 . The non-transitory machine readable medium of claim 11 , wherein the second set of parameters includes at least one parameter identified after receiving the API call.
15 . The non-transitory machine readable medium of claim 14 , wherein the partially evaluated policy is stored in a first storage, wherein the second set of parameters includes at least one parameter retrieved from a second storage after receiving the API call.
16 . The non-transitory machine readable medium of claim 15 , wherein the at least one parameter is retrieved from the second storage based on a parameter received with the API call.
17 . The non-transitory machine readable medium of claim 15 ,
wherein the at least one parameter is retrieved from the second storage and the partially evaluated policy is retrieved from the first storage.
18 . The non-transitory machine readable medium of claim 11 , wherein the policy is a role-based access control (RBAC) policy.
19 . The non-transitory machine readable medium of claim 11 , wherein the portion of the policy is partially evaluated before receiving the API call to reduce computations performed after receiving the API call.
20 . The non-transitory machine readable medium of claim 11 , wherein the second set of parameters comprises parameters available after receiving the API call.
21 . A device comprising:
a memory; and
at least one processor configured to:
before receipt of an application programming interface (API) call to an application, evaluate, based on a first set of available parameters, a portion of a policy for authorizing the API call to produce a partially evaluated policy;
receive the API call to authorize;
evaluate an entirety of the policy using (1) the partially evaluated policy, (2) a second set of parameters, and (3) a second portion of the policy not previously evaluated to produce the partially evaluated policy; and
respond to the API call with a policy decision based on evaluation of the entirety of the policy.
22 . The device of claim 21 , wherein the device comprises a first storage that stores the partially evaluated policy and a second storage distinct from the first storage, and wherein the at least one processor is configured to, after receipt of the API call, identify at least one parameter of the second set and retrieve the identified at least one parameter from the second storage.
23 . The device of claim 22 , wherein retrieving the at least one parameter from the second storage is based on a parameter received with the API call.