Pipeline Directives

Pipeline directives control how a execution pipelines react to the action results. The directive can be explicitly requested using the standalone actions:

• any
• first
• while
• all
• none
• each

Or they can be used as parameters in these actions:

• with
• try

first

Stops on first accept or reject and returns that. If no accept or reject is encountered, ignore is returned.

Example

When you want the first non-ignoring action to provide a result to make the decision

first {
    backend "PRIMARY_AUTH"; # ignores if does not find user
    backend "FALLBACK_AUTH";
}

any

Stop on first accept. If no accept is encountered, return the last reject or ignore.

Example

When calling multile backends or methods where any success is sufficient

any {
    pap;
    chap;
}

while - Default

Stop on reject. Return the last accept or ignore.

NOTE: This is not a loop.

This the default behavior for pipelines. There is really no need to use the standalone while action but it can be used for clarity in the with action.

It should noted that if a policy handler returns ignore as the last action it will still reject the request.

Example

All must accept or ignore

while {
    backend "USER_EXISTS";
    script "CHECK_BUSINESS_HOURS";
}

or since this is the default behavior, you can simply write:

backend "USER_EXISTS";
script "CHECK_BUSINESS_HOURS";

all

All actions must accept. If any action returns ignore or reject, that is returned immediately.

Example

All verifications must succeed

all {
    backend "VALIDATE_USER";
    backend "CHECK_PERMISSIONS";
    backend "VERIFY_LICENSE";
}

none

none is deprecated because its result propagation is difficult to reason about. Use until for explicit result handling.

Returns accept when no action returns accept. The directive continues after reject and ignore, and returns reject immediately when an action returns accept. An empty none block returns accept.

none {
    backend "EMPLOYEE_DB";
    backend "CONTRACTOR_DB";
    backend "VPN_USERS";
}
# must be guest user

each

Return the result of the last action.

Note that this does not capture errors. If you need to catch errors, use the try action.

Example

each {
    # does not matter if these reject or ignore
    backend "STORE_ANALYTICS";
    backend "LOG_ACCESS";

    # this result is returned
    backend "PRIMARY_AUTH";
}