PingAuthorize

Configuring condition short-circuiting in the Policy Editor

By default, the Policy Editor stops evaluating a condition group as soon as a final outcome is determined. This is called short-circuiting.

For example, consider an All condition group that contains three conditions. Because All requires every condition to be true, a single false result determines the outcome.

Screen capture showing a compound payment condition with the ALL operator selected
  • With short-circuiting enabled, evaluation ends immediately if either the Payment amount or Risk score condition evaluates to false.

  • With short-circuiting disabled, the Policy Editor evaluates every condition in the group, regardless of intermediate results.

To ensure a comprehensive audit trail of all condition evaluations in external policy decision point (PDP) mode, you can disable condition short-circuiting. This is useful for debugging complex policy failures.

Steps

  1. Make a copy of the default options.yml file:

    cp <PingAuthorize-PAP>/config/options.yml my-options.yml
  2. In the new options file, under the core section, add the DecisionPoint.EnableShortcircuiting configuration property:

    core:
      DecisionPoint.EnableShortcircuiting: false

    Allowed values are true and false.

  3. Stop the Policy Editor:

    bin/stop-server
  4. Run setup and use the --optionsFile argument to specify the new options file. Customize all other options according to your requirements.

    bin/setup demo \
      --adminUsername admin \
      --generateSelfSignedCertificate \
      --decisionPointSharedSecret pingauthorize \
      --hostname <PAP-hostname> \
      --port <PAP-port> \
      --adminPort <admin-port>  \
      --licenseKeyFile <path-to-license> \
      --optionsFile my-options.yml
  5. Start the Policy Editor:

    bin/start-server