Policy not evaluated

[Gizgio83]

Hi all,
i am currently working with the transfer-02-consumer-pull example you provided and i was able to run this transfer example. My idea was then to extends this example by adding a custom policy by defining a policy evaluation function and then binding it to the policy engine following the instructions provided in tutorial
I couldn't get my policy evaluation function to work but before explaining how i implemented it i wanted to ask first if in the example i was using the policy evaluation is implemented or not.
I am asking that because i also tried to specify a policy just to test the policy mechnanism.
This is the policy i added:

 {
   "@context": {
    "edc": "https://w3id.org/edc/v0.0.1/ns/",
    "odrl": "http://www.w3.org/ns/odrl/2/"
  },
  "@id": "aPolicy",
  "policy": {
    "@context": "http://www.w3.org/ns/odrl.jsonld",
    "@type": "Set",
    "permission": [
      {
        "action": "use",
        "constraint": [
          {
            "leftOperand": "ids:absoluteSpatialPosition",
            "operator": "eq",
            "rightOperand": "us"
          }
        ]
      }
    ],
    "prohibition": [],
    "obligation": []
  }
}

The policy was added correctly (i just called the api ..management/v2/policydefinitions/aPolicy which was returning the policy I specifid so I supposed that the policy was added correctly)

Befrore adding this policy I followed all the previous steps specified in the transfer-02-consumer-pull, I mean I started the two connetors (provider and consumer) i registered the data-plane, added an asset and then I specified the policy I attached above.
After that I create a contract definition for that policy.

A this point, since it is not described anywere I was supposing that the policy I specified was applied to ALL_SCOPES, so I was expecting to see some sort of error in the log already when requesting the catalog, form the consumer connector, considering that no absoluteSpatialPosition is specified in the connector configuration, but nothing happend. I was able to go on by negotiating the contract, getting the aggrement id and at the end I was able to retrieve the asset.

As mentioned above I added an extension on the transfer-00-prerequisites folder to define my custom policy evaluator.
First i implemented my custom service extension this way:

public class ConnectorValidationExtension implements ServiceExtension {
 
    public static final String CONNECTOR_VALIDATION_ID = "CUSTOM_CONNECTOR_ID";    
 
    @Inject
    private RuleBindingRegistry ruleBindingRegistry;
 
    @Inject
    private PolicyEngine policyEngine;
   
    @Override
    public String name() {
        return "Custom policy test";
    }
    
    @Override
    public void initialize(ServiceExtensionContext context) {
        final var monitor = context.getMonitor();
		
        monitor.info("Initializing ConnectorValidationExtension");
        //ruleBindingRegistry.bind("USE", ALL_SCOPES);
        
	ruleBindingRegistry.bind(CONNECTOR_VALIDATION_ID, ContractDefinitionResolver.CATALOGING_SCOPE);
		
        ruleBindingRegistry.bind(CONNECTOR_VALIDATION_ID, ContractDefinitionResolver.CATALOGING_SCOPE);
       
	var permissionFunction = new ConnectorPermissionFunction(monitor);
        // bind the function to the scope
        policyEngine.registerFunction(ContractDefinitionResolver.CATALOGING_SCOPE, Permission.class, CONNECTOR_VALIDATION_ID, permissionFunction);
		
	//policyEngine.registerFunction(ALL_SCOPES, Permission.class, CONNECTOR_VALIDATION_ID, permissionFunction);
    }
}

then i defined the custom AtomicConstraintFunction this way:

public class ConnectorPermissionFunction implements AtomicConstraintFunction<Permission> {
    
    private final Monitor monitor;
    private final String connectorId;
    private static final String CONNECTOR_VALIDATION_CLAIM = "connector_key";
    
    public ConnectorPermissionFunction(Monitor monitor, String connectorId) {
        this.monitor = monitor;
        this.connectorId = connectorId;
        monitor.debug("SUCCESS INITIALIZING ConnectorPermissionFunction");
    }
    
    @Override
    public boolean evaluate(Operator operator, Object rightValue, Permission rule, PolicyContext policyContext) {
        monitor.debug("CUSTOM POLICY EVALUATION FUNCTION EXECUTED!!");
      
        var participant = policyContext.getContextData(ParticipantAgent.class);
        var claims = participant.getClaims();
      
        printAllClaims(claims);

        if (!claims.containsKey(CONNECTOR_VALIDATION_CLAIM)) {
            monitor.severe("No " + CONNECTOR_VALIDATION_CLAIM + " specified!");
            return false;
        }
        var claim = claims.get(CONNECTOR_VALIDATION_CLAIM);
        monitor.info("Retrieved " + CONNECTOR_VALIDATION_CLAIM + " claim: " + claim.toString());
        return rightValue.equals(claim);
    }
    
    //FOR DEBUG ONLY
    private void printAllClaims(Map<String, Object> claim) {
        monitor.debug("LIST ALL THE CLAIMS:");
        for (Entry<String, Object> entry : claim.entrySet()) {
            monitor.debug("Key: " + entry.getKey() + ", Value: " + entry.getValue());
        }
    }
}

Then i specified my extension within a file resources/META-INF/services/org.eclipse.edc.spi.system.ServiceExtension

After re-building the example and running the connector.jar, I noticed on the log these lines:

...
INFO 2024-02-27T11:05:13.782919123 Initializing ConnectorValidationExtension
...
DEBUG 2024-02-27T11:05:13.787006341 SUCCESS INITIALIZING ConnectorPermissionFunction
...
INFO 2024-02-27T11:05:13.789849432 Initialized org.eclipse.edc.custom.functions.ConnectorValidationExtension
...

According to the log i realized that my extension was at least loaded correctly after running the connector. As you can see from the code a posted above, I registered my AtomicConstraintFunction by assenging to it a CATALOGING_SCOPE. I was expecting my policy to be evaluated when a catalog was requesting by a consumer connector. As you can see from the code I also tried to register the function also by assenging ALL_SCOPES.
Anyway in both the cases my policy was not evaluated either in the catalog request or in the other steps because i never noticed the log i added in the evaluate function (CUSTOM POLICY EVALUATION FUNCTION EXECUTED!!) to be printed on the console.

I am wandering what i am missing or doing wrong.

My question are then:

• Is it possibile to add a policy to resctrict the access to the asset in some how using the transfer-02-consumer-pull example or this example is not set up for this purpose?
• Is it necessary to include some other module/configuration to enable the policy evaluation?
• Do you see any errors in the way I tried to test the policy and the way I tried to define a custom service extension to enable the evaluation of my custom policy?

Thanks in advance for the answer.

[ndr-brt]

Hi, my suggestion would be to take a look at the brand new policy sample that has been added yesterday:
https://github.com/eclipse-edc/Samples/tree/main/policy/policy-01-policy-enforcement

[Gizgio83]

Hi,
Thank you for your reply, I think I managed to get my service extension working. I am posting my results that may be useful to someone esle.
I modified my ConnectorValidationExtesion extension in this way:

import static org.eclipse.edc.policy.model.OdrlNamespace.ODRL_SCHEMA;
import static org.eclipse.edc.spi.CoreConstants.EDC_NAMESPACE;

public class ConnectorValidationExtension implements ServiceExtension {
 
    public static final String CONNECTOR_VALIDATION_ID = EDC_NAMESPACE + "CUSTOM_CONNECTOR_ID";    
 
    @Inject
    private RuleBindingRegistry ruleBindingRegistry;
 
    @Inject
    private PolicyEngine policyEngine;
   
    @Override
    public String name() {
        return "Custom policy test";
    }
    
    @Override
    public void initialize(ServiceExtensionContext context) {
        final var monitor = context.getMonitor();
		
        monitor.info("Initializing ConnectorValidationExtension");
		
        ruleBindingRegistry.bind("USE", CATALOGING_SCOPE);
		
        ruleBindingRegistry.bind(ODRL_SCHEMA + "use", CATALOGING_SCOPE);
		
        ruleBindingRegistry.bind(CONNECTOR_VALIDATION_ID, CATALOGING_SCOPE);       
       
	var permissionFunction = new ConnectorPermissionFunction(monitor);
		
        // bind the function to the scope
        policyEngine.registerFunction(CATALOGING_SCOPE, Permission.class, CONNECTOR_VALIDATION_ID, permissionFunction);
		
    }
}

In my previous post i forgot to show the policy I was using, which is this one:

{
	"@context": {
		"edc": "https://w3id.org/edc/v0.0.1/ns/"
	},
	"@id": "aPolicy",
	"@type": "PolicyDefinition",
	"policy": {
		"@context": "http://www.w3.org/ns/odrl.jsonld",
		"@type": "Set",
		"uid": "http://example.com/policy:1010",
		"permission": [
			{
				"target": "assetId",
				"action": "use",
				"constraint": [
					{
						"leftOperand": "CUSTOM_CONNECTOR_ID",
						"operator": "eq",
						"rightOperand": "consumer_allowed"
					}
				]
			}
		]
	}
}

With this changes i was able to enable the policy evaluation when a consumer connector try to request the catalog.

In any case, thank you for the policy example you added. Really appreciated.

Regards.