[英]Comparing specific custom-defined attribute of user
For an XACML policy document I had in mind, I have a subject (user) and an object, each attached with a label. 对于我想到的XACML策略文档,我有一个主题(用户)和一个对象,每一个都带有标签。 Let's call this
myLabel = {[a,b,c], [1,2,3]}
. 我们称其为
myLabel = {[a,b,c], [1,2,3]}
。 I wish to do a comparison of parts of this label. 我希望对该标签的各个部分进行比较。
How can I define a subject and object to contain this label in the access request and policy to formulate a decision to compare this? 如何定义访问请求和策略中包含此标签的主题和对象,以制定比较此决定的决定?
I wish to use XML rather than JSON or ALFA to declare the above. 我希望使用XML而不是JSON或ALFA来声明以上内容。
XACML (and ALFA) comes with a set of clearly defined data types and functions. XACML(和ALFA)带有一组明确定义的数据类型和功能。 For instance XACML defines the following datatypes:
例如,XACML定义以下数据类型:
There are 18 or so datatypes out-of-the-box. 现成的数据类型大约有18种。
To work on those datatypes, XACML defines hundreds of functions such as: 为了处理这些数据类型,XACML定义了数百种功能,例如:
Attributes in XACML (eg label or role or department) must have a datatype. XACML中的属性(例如标签,角色或部门)必须具有数据类型。 Attributes can be multi-valued.
属性可以是多值的。 In other words,
role = ["manager"]
or role = ["manager", "employee", "janitor"]
. 换句话说,
role = ["manager"]
或role = ["manager", "employee", "janitor"]
。 Both are perfectly valid. 两者都是完全有效的。
In your case, you are referring to a value structured as follows: {[a,b,c],[1,2,3]}
. 就您而言,您所指的值结构如下:
{[a,b,c],[1,2,3]}
。 This is not a standard datatype. 这不是标准数据类型。 It's a complex object and as such would require further processing (in a PEP? in a PIP?).
这是一个复杂的对象,因此需要进一步处理(在PEP中?在PIP中?)。 How were you thinking of passing it to the PDP?
您如何考虑将其传递给PDP?
Let's assume we have simple values eg label = '2'. 假设我们有简单的值,例如label ='2'。 To compare a user's label to a resource's label and grant access if they are equal, you would write the following:
要将用户的标签与资源的标签进行比较,并在它们相等时授予访问权限,请编写以下代码:
/**
* Control access based on labels
*/
policy labelAccessControl{
apply firstApplicable
rule allowIfSameLabel{
permit
condition user.label == object.label
}
}
<?xml version="1.0" encoding="UTF-8"?><!--This file was generated by the
ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). --><!--Any modification to this file will
be lost upon recompilation of the source ALFA file -->
<xacml3:Policy
xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
PolicyId="http://axiomatics.com/alfa/identifier/com.axiomatics.labelAccessControl"
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
Version="1.0">
<xacml3:Description>Control access based on labels</xacml3:Description>
<xacml3:PolicyDefaults>
<xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116
</xacml3:XPathVersion>
</xacml3:PolicyDefaults>
<xacml3:Target />
<xacml3:Rule Effect="Permit"
RuleId="com.axiomatics.labelAccessControl.allowIfSameLabel">
<xacml3:Description />
<xacml3:Target />
<xacml3:Condition>
<xacml3:Apply
FunctionId="urn:oasis:names:tc:xacml:3.0:function:any-of-any">
<xacml3:Function
FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal" />
<xacml3:AttributeDesignator
AttributeId="com.axiomatics.user.label"
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
DataType="http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false" />
<xacml3:AttributeDesignator
AttributeId="com.axiomatics.object.label"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
DataType="http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false" />
</xacml3:Apply>
</xacml3:Condition>
</xacml3:Rule>
</xacml3:Policy>
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.