Policy Decision Logger

Enabled by default, the Policy Decision Logger records decision responses that are received from the policy decision point (PDP).

Regardless of whether PingAuthorize Server is configured to evaluate a policy in embedded or external mode, a policy-decision file logs every policy decision per request. The file is located at PingAuthorize/logs/policy-decision and contains the following information:

Policy-decision response: Each client request triggers a policy-decision response that specifies the inbound actions to perform, and another policy-decision response that specifies the outbound actions to perform. If you think of a policy-decision response as a set or decision tree of policies, all inbound and outbound requests are read from that set or tree.

Policy rules determine whether a request is denied, permitted, or indeterminate.

Most recent policy decision: To debug the most recent inbound request, open the policy-decision log file and locate the highest DECISION requestID in the section near the bottom of the file.

Alternatively, you can use the most recent request timestamp to locate the most recent request.

Policy statements: If the policy contains a statement, it is logged after the policy-decision response JSON. Statements feature the same corresponding requestID as the most recent policy decision.

To increase the level of detail that is returned in PDP decision responses, configure the Policy Decision Service as follows:

dsconfig set-policy-decision-service-prop \
  --add decision-response-view:decision-tree \
  --add decision-response-view:request \
  --add decision-response-view:evaluated-entities \
  --add decision-response-view:evaluation-log-with-attribute-values

Policy Decision views also affect the decision response payload of the request. You can remove added views by using the --remove decision-response-view:<view_name> argument. See About the Decision Response View for more information.

Configurable attribute logging for embedded mode

When running the Policy Decision Service in embedded mode, you can exercise some control over which attributes get logged as part of the policy-decision response. The dsconfig set-policy-decision-service-prop command supports an attribute-logging argument. This argument allows you to log the full details of the specified attributes when they’re evaluated as part of the policy-decision request.

Here’s an example of how to use the attribute-logging argument for embedded mode:

dsconfig set-policy-decision-service-prop \
  --set embedded-mode-logged-attributes:<attribute1>  \
  --set embedded-mode-logged-attributes:<attribute2>

Attributes specified using this argument are only logged if they get evaluated as part of the of policy-decision request. Enabling certain decision response views could override this configuration and cause all evaluated attributes to be included in the response.

Including additional attributes could cause the Trace Log Publisher or the Policy Decision Log Publisher to record sensitive data.