Does Wso2 Identity Server support MDP via JSON?

Question

I have an XML XACML Request with multiple decision profile (MDP) elements - more than one category of the same type, and, optionally, MultipleRequest element. This request works correctly with Wso2 IS 5.3.0.

But if I try to rewrite this request in JSON form, corresponding to XACML JSON Profile, Wso2IS not handle it as expected:

• if I use MultiRequest object, server returns error (40020) "Request Parse Exception"
• if I just enum several category objects as arrays, without explicit MultiRequest, server does not found any attribute values in these categories

Single-decision requests in JSON handled correctly with wso2is 5.3.0.

Is this behavior of wso2is is expected due to current design limitations, or, may be, I wrote a wrong JSON MDP Request?

My XML XACML Request (case with explicit MultiRequest):

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" 
    CombinedDecision="false" 
    ReturnPolicyIdList="true">

    <Attributes id="res-01" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Id" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">lesson_834570716063946</AttributeValue>
        </Attribute>
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Uot.ResponsiblePersonId" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">person_456454345234353</AttributeValue>
        </Attribute>
    </Attributes>

    <Attributes id="res-02" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Id" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">lesson_8345707160639460</AttributeValue>
        </Attribute>
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Uot.ResponsiblePersonId" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">person_4564543452343530</AttributeValue>
        </Attribute>
    </Attributes>  

    <Attributes id="res-03" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Id" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">lesson_834570716063947</AttributeValue>
        </Attribute>
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Uot.ResponsiblePersonId" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">person_456454345234353</AttributeValue>
        </Attribute>
    </Attributes>  

    <Attributes id="subj" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">uid_1234567</AttributeValue>
        </Attribute>
        <Attribute AttributeId="urn:mytest:testapp:xacml:subject:person-id" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">person_456454345234353</AttributeValue>
        </Attribute>
        <Attribute AttributeId="urn:mytest:testapp:xacml:subject:permissions:LessonOperationsOnMyOwnUots-enabled" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue>
        </Attribute>
    </Attributes>

    <Attributes id="act-01" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action">
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Courses.EditLesson</AttributeValue>
        </Attribute>
    </Attributes>

    <Attributes id="act-02" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action">
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Courses.EditLesson</AttributeValue>
        </Attribute>
    </Attributes>

    <MultiRequests>
        <RequestReference>
            <AttributesReference ReferenceId="subj"/>
            <AttributesReference ReferenceId="act-01"/>
            <AttributesReference ReferenceId="res-01"/>
        </RequestReference>
        <RequestReference>
            <AttributesReference ReferenceId="subj"/>
            <AttributesReference ReferenceId="act-01"/>
            <AttributesReference ReferenceId="res-02"/>
        </RequestReference>
        <RequestReference>
            <AttributesReference ReferenceId="subj"/>
            <AttributesReference ReferenceId="act-02"/>
            <AttributesReference ReferenceId="res-03"/>
        </RequestReference>
    </MultiRequests>

</Request>

My JSON XACML request:

{
    "Request": {
        "CombinedDecision": false,
        "ReturnPolicyIdList": true,

        "Category": [
            {
                "Id": "res-01",
                "CategoryId": "urn:oasis:names:tc:xacml:3.0:attribute-category:resource",
                "Attribute": [
                    {
                        "AttributeId": "urn:mytest:testapp:xacml:resource:property-chain:Lesson.Id",
                        "Value": "lesson_834570716063946"
                    },
                    {
                        "AttributeId": "urn:mytest:testapp:xacml:resource:property-chain:Lesson.Uot.ResponsiblePersonId",
                        "Value": "person_456454345234353"
                    }
                ]
            },
            {
                "Id": "res-02",
                "CategoryId": "urn:oasis:names:tc:xacml:3.0:attribute-category:resource",
                "Attribute": [
                    {
                        "AttributeId": "urn:mytest:testapp:xacml:resource:property-chain:Lesson.Id",
                        "Value": "lesson_8345707160639460"
                    },
                    {
                        "AttributeId": "urn:mytest:testapp:xacml:resource:property-chain:Lesson.Uot.ResponsiblePersonId",
                        "Value": "person_4564543452343530"
                    }
                ]
            }
        ],

        "AccessSubject": {
            "Id": "subj",
            "Attribute": [
                {
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:subject:subject-id",
                    "Value": "uid_1234567"
                },
                {
                    "AttributeId": "urn:mytest:testapp:xacml:subject:person-id",
                    "Value": "person_456454345234353"
                },
                {
                    "AttributeId": "urn:mytest:testapp:xacml:subject:permissions:LessonOperationsOnMyOwnUots-enabled",
                    "DataType": "boolean",
                    "Value": true
                }
            ]
        },

        "Action": {
            "Id": "act-01",
            "Attribute": [
                {
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "Courses.CreateLesson"
                }
            ]
        },

        "MultiRequests": {
            "RequestReference": [
                {
                    "ReferenceId": ["res-01","act-01","subj"]
                },
                {
                    "ReferenceId": ["res-02","act-01","subj"]
                }
            ]
        }       
    }
}  

Answer 1

The short answer is no, it does not, based on your test.

I tested your XACML request against the Axiomatics Policy Server and it works fine. Here is the response in JSON format:

{
    "Response":[
        {
            "Decision":"NotApplicable",
            "Status":{
                "StatusCode":{
                    "Value":"urn:oasis:names:tc:xacml:1.0:status:ok",
                    "StatusCode":{
                        "Value":"urn:oasis:names:tc:xacml:1.0:status:ok"
                    }
                }
            },
            "PolicyIdentifierList":{

            }
        },
        {
            "Decision":"NotApplicable",
            "Status":{
                "StatusCode":{
                    "Value":"urn:oasis:names:tc:xacml:1.0:status:ok",
                    "StatusCode":{
                        "Value":"urn:oasis:names:tc:xacml:1.0:status:ok"
                    }
                }
            },
            "PolicyIdentifierList":{

            }
        }
    ]
}