# Writing HTTP check rules

oslo.policy has supported the following syntax for a while:

    http:<target URL>, which delegates the check to a remote server

Starting with 1.29, oslo.policy will also support https url(s) as well:

    https:<target URL>, which delegates the check to a remote server

Both `http` and `https` support are implemented as custom check rules. If you see the setup.cfg for oslo.policy, you can see the following entry points:

    oslo.policy.rule_checks =
        http = oslo_policy._external:HttpCheck
        https = oslo_policy._external:HttpsCheck

When a policy is evaluated, when the engine encounters `https` like in a snippet below:

    {
           ...
           "target 1" : "https://foo.bar/baz",
           ...
    }

The engine will look for a plugin named `https` in the `rule_checks` entry point and will try to invoke that stevedore plugin.

This mechanism allows anyone to write their own code, in their own library with their own custom stevedore based rule check plugins and can enhance their policies with custom checks. This would be useful for example to integrate with an in-house policy server.

## Example code - HttpCheck

Note

Full source located at _external.py

     1
     2if TYPE_CHECKING:
     3    from oslo_policy.policy import Enforcer
     4
     5
     6class HttpCheck(_checks.Check):
     7    """Check ``http:`` rules by calling to a remote server.
     8
     9    This example implementation simply verifies that the response
    10    is exactly ``True``.
    11    """
    12
    13    def __call__(
    14        self,
    15        target: _checks.TargetT,
    16        creds: _checks.CredsT,
    17        enforcer: 'Enforcer',
    18        current_rule: str | None = None,
    19    ) -> bool:
    20        timeout = enforcer.conf.oslo_policy.remote_timeout
    21
    22        url = ('http:' + self.match) % target
    23        data, json = self._construct_payload(
    24            creds, current_rule, enforcer, target
    25        )
    26        try:
    27            with contextlib.closing(
    28                requests.post(url, json=json, data=data, timeout=timeout)
    29            ) as r:
    30                return bool(r.text.lstrip('"').rstrip('"') == 'True')
    31        except Timeout:
    32            raise RuntimeError('Timeout in REST API call')
    33
    34    @staticmethod
    35    def _construct_payload(
    36        creds: _checks.CredsT,
    37        current_rule: str | None,

this page last updated: 2026-07-15 00:36:21

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug