[英]Using XACML to express policy which is a logical expression
I am very new to XACML. 我对XACML非常陌生。 And I am using XACML to express policy. 我正在使用XACML来表达政策。 But I can't find any good examples except a few from the OASIS XACML Technical Committee . 但是除了OASIS XACML技术委员会的几个例子外,我找不到任何好的例子。
Ok, here is my question: 好的,这是我的问题:
I want to express policy using XACML. 我想使用XACML表示政策。 Users can access to the resources only if they satisfy the policy. 用户只有满足策略才能访问资源。 The policy is an logical expression. 该策略是一个逻辑表达式。 For example: 例如:
(not A1) and (A2 OR A3) and (2 of (A4, A5,A6)) (不是A1)和(A2或A3)和((A4,A5,A6中的2)
2 of (A4,A5,A6) refers that it is true only if 2 or more of A4,A5,A6 is true. (A4,A5,A6)中的2表示仅当A4,A5,A6中的2个或更多为真时才为真。
"AllOf" and "AnyOf" can be used to express "AND" and "OR", but I don't know how to express "2 of (A4,A5,A6)" and "not A1". “ AllOf”和“ AnyOf”可用于表示“ AND”和“ OR”,但我不知道如何表示“(A4,A5,A6)中的2个”和“非A1”。
Thank you! 谢谢!
Based on the requirement you have, you need to use a XACML condition. 根据您的要求,您需要使用XACML条件。 Conditions live within rules only so this means you'll have to put your logic inside the rule. 条件仅存在于规则之内,因此这意味着您必须将逻辑放入规则中。
This is because you will need a function not allowed in XACML targets: n-of. 这是因为您将需要XACML目标中不允许的功能:n-of。
This is also because a XACML Target cannot have negative expressions. 这也是因为XACML目标不能包含否定表达式。 The only way you can express Not(A1) is via a condition. 表示Not(A1)的唯一方法是通过条件。
The reason for that is that XACML deals with attribute bags. 原因是XACML处理属性包。 So when you write in a target: 因此,当您写入目标时:
role==manager
What you are in fact saying is: if the user has at least one role equal to manager... 您实际上是在说:如果用户至少具有一个等于经理的角色...
So what would the opposite of that be? 那么相反的是什么呢?
With respect to your 2 of (a,b,c), you can use the XACML function called n-of (urn:oasis:names:tc:xacml:1.0:function:n-of defined in A.3.5 Logical functions ) 关于(a,b,c)中的2个,您可以使用称为n-of的XACML函数(在A.3.5逻辑函数中定义的urn:oasis:names:tc:xacml:1.0:function:n-of)
The outcome is in ALFA 结果在ALFA中
/**
* (not A1) and (A2 OR A3) and (2 of (A4, A5,A6))
*/
policy stackoverflow{
apply firstApplicable
rule so{
condition not(A1=="some value") && (A2=="" || A3=="") && nOf(2, stringOneAndOnly(A4)=="value", stringOneAndOnly(A5)=="value", stringOneAndOnly(A6)=="value")
permit
}
}
In the example above I made A1 through A6 string attributes instead of boolean to show how you would compare with values. 在上面的示例中,我设置了A1到A6字符串属性,而不是布尔值,以显示如何与值进行比较。 Note that I have to use the stringOneAndOnly function to make sure there is a single value for each of the attributes used in the nOf function. 请注意,我必须使用stringOneAndOnly函数来确保nOf函数中使用的每个属性都有一个单一值。
The XACML output is the following: XACML输出如下:
<?xml version="1.0" encoding="UTF-8"?>
<!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com).
Any modification to this file will be lost upon recompilation of the source ALFA file-->
<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
PolicyId="http://axiomatics.com/alfa/identifier/policing.principles.stackoverflow"
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
Version="1.0">
<xacml3:Description>(not A1) and (A2 OR A3) and (2 of (A4, A5,A6))</xacml3:Description>
<xacml3:PolicyDefaults>
<xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
</xacml3:PolicyDefaults>
<xacml3:Target />
<xacml3:Rule
Effect="Permit"
RuleId="http://axiomatics.com/alfa/identifier/policing.principles.stackoverflow.so">
<xacml3:Description />
<xacml3:Target />
<xacml3:Condition>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not" >
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
<xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">some value</xacml3:AttributeValue>
<xacml3:AttributeDesignator
AttributeId="A1"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
</xacml3:Apply>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
<xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string"></xacml3:AttributeValue>
<xacml3:AttributeDesignator
AttributeId="A2"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
<xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string"></xacml3:AttributeValue>
<xacml3:AttributeDesignator
AttributeId="A3"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
</xacml3:Apply>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:n-of" >
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#integer">2</xacml3:AttributeValue>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only" >
<xacml3:AttributeDesignator
AttributeId="A4"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">value</xacml3:AttributeValue>
</xacml3:Apply>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only" >
<xacml3:AttributeDesignator
AttributeId="A5"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">value</xacml3:AttributeValue>
</xacml3:Apply>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only" >
<xacml3:AttributeDesignator
AttributeId="A6"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">value</xacml3:AttributeValue>
</xacml3:Apply>
</xacml3:Apply>
</xacml3:Apply>
</xacml3:Apply>
</xacml3:Condition>
</xacml3:Rule>
</xacml3:Policy>
--- EDIT --- -编辑-
To express negative conditions eg not(gender==male), you have two options: 要表达负面条件,例如不表达(性别==男性),您有两种选择:
In the former case you can write the following: 在前一种情况下,您可以编写以下内容:
policy checkGender{
apply firstApplicable
rule male{
target clause gender=="male"
permit
}
rule female{
target clause gender=="female"
permit
}
/**
* Optionally add a catch all case
*/
rule other{
target clause ... // Here you'd have to define other checks you are interested in
}
}
In the latter case, you need to write a negative condition. 在后一种情况下,您需要写一个否定条件。 To do that you need to use a XACML condition. 为此,您需要使用XACML条件。 Since XACML conditions only live inside rules, you need to go down to the XACML Rule level. 由于XACML条件仅存在于规则内,因此您需要进入XACML规则级别。
policy checkGender{
apply firstApplicable
rule notMale{
condition not(gender=="male")
permit
}
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.