FIWARE Idm 中的高级 XACML 规则示例

Question

I have issues when creating dynamic resources in IDM, question about that was answered here .

But i was not able to find clear example of creating advanced policy using costume XCAML. Documentation on this topic is very unclear and hard to understand, without some examples.

So my question is if some was able to create some dynamic resources using methods i described above.

Answer 1

For an Advanced XACML Rule, you can start from the XACML Rule template in the IDM source code as example, which is used to generate a basic Rule (for a static resource path); then you can customize it (besides removing/replacing the template code <%...%> ) but beware that in the Rule, you can only use XACML attributes that can be retrieved by the PEP. If you use FIWARE PEP proxy Wilma as PEP, you can check the list of usable XACML attributes by looking at thePep's Authzforce client code (search for AttributeId ). Currently, they are the following (names shortened for conciseness): resource-id, sub-resource-id, action-id, subject-role (check the code for the full attribute names). Therefore, if you want to use XACML subject-id attribute based on user-id in your Rule for example, you have to modify the Pep code I just mentioned, ie extract the user ID from the userInfo variable and add the corresponding XACML Attribute (subject-id) in the Request.