Guard policies are used to limit what operations shall be permitted. These policies are specified in the Policy GUI or restful API and either return "PERMIT" or "DENY" on request.
-There are 2 types of policies, guard policies and blacklist guard policies. The blacklist describes what is not allowed to be permitted and guard policies describe what is allowed to be permitted. Note: as of 1802 release, Policy PDP behaves as a PERMIT overrides fashion so if any policy permits, it will override any denies.
+There are 2 types of policies, guard policies and blacklist guard policies. The blacklist describes what is not allowed to be permitted and guard policies describe what is allowed to be permitted. The Policy PDP behaves in a PERMIT overrides fashion, that is, if any policy permits, it will override any denies.
+
+.. note:: *Limit Functionality*: The determination to deny a request because it has exceeded the limit is based on the number of entries in the **database**.
Creating Guard Policies
^^^^^^^^^^^^^^^^^^^^^^^
The GUARD policy can be created from the POLICY GUI as shown below.
-.. note::
- * The Onap Name must be empty for the policy to work. To do this, **clone** the policy provided and then edit.
- * Even though the number of requests exceeds the limit, the request is not denied.
-
.. image:: PolicyGUI_GuardPolicy.png
-|
+In a Blacklist policy, the blacklist entries can be entered either manually or imported from an excel sheet. This import option can also be used to delete existing blacklist entries and to add new entries.
+
+.. image:: PolicyGUI_BlacklistPolicy.png
+
API Method
----------
-PUT /createPolicy to create a policy
+To create the policy, use the PUT /createPolicy API. This request uses Basic Access Authentication.
-The request should be in the following form for regular guard policy:
+The request should be in the following form for the regular guard policy:
-.. code-block:: bash
+.. code-block:: json
:caption: Regular Guard Policy Creation
:linenos:
The request should be in the following form for blacklist guard policy:
-.. code-block:: bash
+.. code-block:: json
:caption: Blacklist Guard Policy Creation
:linenos:
Environment:<environment> Content-Type:application/json < guard_request.json
| where:
-| <yourAuth> is the string generated from user:pass converted to base64 encoding.
-| <yourClientAuth> is generated the same way but from the client user and pass.
-| <environment> is the context of the request. For example: TEST
+| *<yourAuth>* is the string generated from user:pass converted to base64 encoding.
+| *<yourClientAuth>* is generated the same way but from the client user and pass.
+| *<environment>* is the context of the request. For example: TEST
The guard_request.json should be in the form of the following:
"onapName": "PDPD"
}
-A response should be received that contains a "PERMIT" or "DENY" in all caps, like the following:
+A response containing a “PERMIT” or “DENY” in uppercase is returned as follows:
.. code-block:: json
:caption: Response
}
-Additional Information
-^^^^^^^^^^^^^^^^^^^^^^
+End of Document
-Additional information can be found at `GuardPolicy link`_
+.. SSNote: Wiki page ref. https://wiki.onap.org/display/DW/Creating+and+Using+Guard+Policies
-.. _GuardPolicy link: https://wiki.onap.org/display/DW/Creating+and+Using+Guard+Policies
Code Review / policy / engine.git / blobdiff