For an XACML policy document I had in mind, I have a subject (user) and an object, each attached with a label. Let's call this myLabel = {[a,b,c], [1,2,3]}
. I wish to do a comparison of parts of this label.
How can I define a subject and object to contain this label in the access request and policy to formulate a decision to compare this?
I wish to use XML rather than JSON or ALFA to declare the above.
XACML (and ALFA) comes with a set of clearly defined data types and functions. For instance XACML defines the following datatypes:
There are 18 or so datatypes out-of-the-box.
To work on those datatypes, XACML defines hundreds of functions such as:
Attributes in XACML (eg label or role or department) must have a datatype. Attributes can be multi-valued. In other words, role = ["manager"]
or role = ["manager", "employee", "janitor"]
. Both are perfectly valid.
In your case, you are referring to a value structured as follows: {[a,b,c],[1,2,3]}
. This is not a standard datatype. It's a complex object and as such would require further processing (in a PEP? in a PIP?). How were you thinking of passing it to the PDP?
Let's assume we have simple values eg label = '2'. To compare a user's label to a resource's label and grant access if they are equal, you would write the following:
/**
* Control access based on labels
*/
policy labelAccessControl{
apply firstApplicable
rule allowIfSameLabel{
permit
condition user.label == object.label
}
}
<?xml version="1.0" encoding="UTF-8"?><!--This file was generated by the
ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). --><!--Any modification to this file will
be lost upon recompilation of the source ALFA file -->
<xacml3:Policy
xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
PolicyId="http://axiomatics.com/alfa/identifier/com.axiomatics.labelAccessControl"
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
Version="1.0">
<xacml3:Description>Control access based on labels</xacml3:Description>
<xacml3:PolicyDefaults>
<xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116
</xacml3:XPathVersion>
</xacml3:PolicyDefaults>
<xacml3:Target />
<xacml3:Rule Effect="Permit"
RuleId="com.axiomatics.labelAccessControl.allowIfSameLabel">
<xacml3:Description />
<xacml3:Target />
<xacml3:Condition>
<xacml3:Apply
FunctionId="urn:oasis:names:tc:xacml:3.0:function:any-of-any">
<xacml3:Function
FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal" />
<xacml3:AttributeDesignator
AttributeId="com.axiomatics.user.label"
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
DataType="http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false" />
<xacml3:AttributeDesignator
AttributeId="com.axiomatics.object.label"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
DataType="http://www.w3.org/2001/XMLSchema#string"
MustBePresent="false" />
</xacml3:Apply>
</xacml3:Condition>
</xacml3:Rule>
</xacml3:Policy>
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.