使用MongoDB for Authzforce将XACML文件存储在JSON中

Question

I would like to implement a PDP engine using the authzforce-ce-core-pdp-engine jar file like you mentioned in the README, but with exception of the policy files in XML should be dynamic. The main idea is similar to file sharing system as one user could share multiple files to other user with each file may have different policy. I was thinking to store the policy files in some sort of DB like MySQL or MongoDB and PDP will refer to it and make a decision to grant or deny the access based on the request.

I found that the pdp core engine supports MongoDB as mentioned here .

Here is my pdp configuration file:

<?xml version="1.0" encoding="UTF-8"?>
<!-- Testing parameter 'maxPolicySetRefDepth' -->
<pdp xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://authzforce.github.io/core/xmlns/pdp/6.0" xmlns:ext="http://authzforce.github.io/core/xmlns/test/3" version="6.0.0">
   <refPolicyProvider id="refPolicyProvider" xsi:type="ext:MongoDBBasedPolicyProvider" serverHost="localhost" serverPort="27017" dbName="testXACML" collectionName="policies" />
   <rootPolicyProvider id="rootPolicyProvider" xsi:type="StaticRefBasedRootPolicyProvider">
      <policyRef>root-rbac-policyset</policyRef>
   </rootPolicyProvider>
</pdp>

So now the question is that how can I store the policy XML files as it needs to be stored in JSON with MongoDB? I tried to convert XML to JSON using JSON maven dependency , but I have a problem of converting back to XML. For example with the policy XML file like this it will create the JSON file something like this:

{"Policy": {
    "xmlns": "urn:oasis:names:tc:xacml:3.0:core:schema:wd-17",
    "Target": "",
    "Description": "Policy for Conformance Test IIA001.",
    "Version": 1,
    "xmlns:xsi": "http://www.w3.org/2001/XMLSchema-instance",
    "RuleCombiningAlgId": "urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-overrides",
    "Rule": {
        "Target": {"AnyOf": [
            {"AllOf": {"Match": {
                "AttributeValue": {
                    "DataType": "http://www.w3.org/2001/XMLSchema#string",
                    "content": "Julius Hibbert"
                },
                "AttributeDesignator": {
                    "Category": "urn:oasis:names:tc:xacml:1.0:subject-category:access-subject",
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:subject:subject-id",
                    "MustBePresent": false,
                    "DataType": "http://www.w3.org/2001/XMLSchema#string"
                },
                "MatchId": "urn:oasis:names:tc:xacml:1.0:function:string-equal"
            }}},
            {"AllOf": {"Match": {
                "AttributeValue": {
                    "DataType": "http://www.w3.org/2001/XMLSchema#anyURI",
                    "content": "http://medico.com/record/patient/BartSimpson"
                },
                "AttributeDesignator": {
                    "Category": "urn:oasis:names:tc:xacml:3.0:attribute-category:resource",
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                    "MustBePresent": false,
                    "DataType": "http://www.w3.org/2001/XMLSchema#anyURI"
                },
                "MatchId": "urn:oasis:names:tc:xacml:1.0:function:anyURI-equal"
            }}},
            {"AllOf": [
                {"Match": {
                    "AttributeValue": {
                        "DataType": "http://www.w3.org/2001/XMLSchema#string",
                        "content": "read"
                    },
                    "AttributeDesignator": {
                        "Category": "urn:oasis:names:tc:xacml:3.0:attribute-category:action",
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                        "MustBePresent": false,
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    },
                    "MatchId": "urn:oasis:names:tc:xacml:1.0:function:string-equal"
                }},
                {"Match": {
                    "AttributeValue": {
                        "DataType": "http://www.w3.org/2001/XMLSchema#string",
                        "content": "write"
                    },
                    "AttributeDesignator": {
                        "Category": "urn:oasis:names:tc:xacml:3.0:attribute-category:action",
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                        "MustBePresent": false,
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    },
                    "MatchId": "urn:oasis:names:tc:xacml:1.0:function:string-equal"
                }}
            ]}
        ]},
        "Description": "Julius Hibbert can read or write Bart Simpson's medical record.",
        "RuleId": "urn:oasis:names:tc:xacml:2.0:conformance-test:IIA1:rule",
        "Effect": "Permit"
    },
    "PolicyId": "urn:oasis:names:tc:xacml:2.0:conformance-test:IIA1:policy"
}}

but when I try to convert it back to XML it becomes entirely different XML file. So now how can I store the XML file in MongoDB? Also how to ensure that pdp engine core could find the correct policy to be compared? I saw there is a mentioned about the json adapter in README like this but I am not sure how to implement it normally.

Answer 1

I answered this question on AuthzForce's github . In a nutshell, David is mostly right about the format (xml content stored as JSON string). More precisely, for AuthzForce MongoDB policy Provider, you have to store policies as shown by the part of the unit test class 's setupBeforeClass method that populates the database with test policies. You'll see that we use the Jongo library (using Jackson object mapping behind the curtains) to map PolicyPOJO Java objects to JSON in the Mongodb collection. So from the PolicyPOJO class, you can pretty much guess the storage format of policies in JSON: it is a JSON object with the following fields (key-value pairs):

• "id" (string): the Policy(Set) ID
• "version" (string): the Policy(Set) version
• "type" (string): the Policy(Set) type, ie '{urn:oasis:names:tc:xacml:3.0:core:schema:wd-17}Policy' (resp. '{urn:oasis:names:tc:xacml:3.0:core:schema:wd-17}PolicySet') for XACML 3.0 Policy (resp. PolicySet)
• "content" (string): the actual Policy(Set)'s XML document as string (plain text)

The xml content is automatically escaped properly by the Java library (Jongo/Jackson) to fit in a JSON string. But if you use another library/language, make sure it is the case as well.

Answer 2

There currently isn't a JSON format for XACML policies. That's currently under consideration by the OASIS XACML Technical Committee. Bernard Butler at Waterford Institute of Technology did do some initial translation which might be of value to you.

The only other option I could think of for the time being is to create a JSON wrapper around the policies eg

{
    "policy":"the xml policy contents escaped as valid json value or in base64"
}