Wso2 Identity Server是否通过JSON支持MDP？

Question

我有一个带有多个决策概要文件（MDP）元素的XML XACML请求-多个相同类型的类别，以及（可选）MultipleRequest元素。 此请求可与Wso2 IS 5.3.0一起正常使用。

但是，如果我尝试以JSON格式（对应于XACML JSON概要文件）重写此请求，则Wso2IS不会按预期处理该请求：

• 如果我使用MultiRequest对象，则服务器返回错误（40020）“请求解析异常”
• 如果我只是将几个类别对象枚举为数组，而没有显式的MultiRequest，则服务器在这些类别中找不到任何属性值

使用wso2is 5.3.0正确处理了JSON中的单决策请求。

由于当前的设计限制，wso2is的这种行为是否可以预期，或者我写错了JSON MDP Request？

我的XML XACML请求（带有显式MultiRequest的情况）：

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" 
    CombinedDecision="false" 
    ReturnPolicyIdList="true">

    <Attributes id="res-01" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Id" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">lesson_834570716063946</AttributeValue>
        </Attribute>
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Uot.ResponsiblePersonId" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">person_456454345234353</AttributeValue>
        </Attribute>
    </Attributes>

    <Attributes id="res-02" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Id" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">lesson_8345707160639460</AttributeValue>
        </Attribute>
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Uot.ResponsiblePersonId" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">person_4564543452343530</AttributeValue>
        </Attribute>
    </Attributes>  

    <Attributes id="res-03" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Id" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">lesson_834570716063947</AttributeValue>
        </Attribute>
        <Attribute AttributeId="urn:mytest:testapp:xacml:resource:property-chain:Lesson.Uot.ResponsiblePersonId" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">person_456454345234353</AttributeValue>
        </Attribute>
    </Attributes>  

    <Attributes id="subj" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">uid_1234567</AttributeValue>
        </Attribute>
        <Attribute AttributeId="urn:mytest:testapp:xacml:subject:person-id" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">person_456454345234353</AttributeValue>
        </Attribute>
        <Attribute AttributeId="urn:mytest:testapp:xacml:subject:permissions:LessonOperationsOnMyOwnUots-enabled" IncludeInResult="false">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue>
        </Attribute>
    </Attributes>

    <Attributes id="act-01" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action">
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Courses.EditLesson</AttributeValue>
        </Attribute>
    </Attributes>

    <Attributes id="act-02" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action">
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Courses.EditLesson</AttributeValue>
        </Attribute>
    </Attributes>

    <MultiRequests>
        <RequestReference>
            <AttributesReference ReferenceId="subj"/>
            <AttributesReference ReferenceId="act-01"/>
            <AttributesReference ReferenceId="res-01"/>
        </RequestReference>
        <RequestReference>
            <AttributesReference ReferenceId="subj"/>
            <AttributesReference ReferenceId="act-01"/>
            <AttributesReference ReferenceId="res-02"/>
        </RequestReference>
        <RequestReference>
            <AttributesReference ReferenceId="subj"/>
            <AttributesReference ReferenceId="act-02"/>
            <AttributesReference ReferenceId="res-03"/>
        </RequestReference>
    </MultiRequests>

</Request>

我的JSON XACML请求：

{
    "Request": {
        "CombinedDecision": false,
        "ReturnPolicyIdList": true,

        "Category": [
            {
                "Id": "res-01",
                "CategoryId": "urn:oasis:names:tc:xacml:3.0:attribute-category:resource",
                "Attribute": [
                    {
                        "AttributeId": "urn:mytest:testapp:xacml:resource:property-chain:Lesson.Id",
                        "Value": "lesson_834570716063946"
                    },
                    {
                        "AttributeId": "urn:mytest:testapp:xacml:resource:property-chain:Lesson.Uot.ResponsiblePersonId",
                        "Value": "person_456454345234353"
                    }
                ]
            },
            {
                "Id": "res-02",
                "CategoryId": "urn:oasis:names:tc:xacml:3.0:attribute-category:resource",
                "Attribute": [
                    {
                        "AttributeId": "urn:mytest:testapp:xacml:resource:property-chain:Lesson.Id",
                        "Value": "lesson_8345707160639460"
                    },
                    {
                        "AttributeId": "urn:mytest:testapp:xacml:resource:property-chain:Lesson.Uot.ResponsiblePersonId",
                        "Value": "person_4564543452343530"
                    }
                ]
            }
        ],

        "AccessSubject": {
            "Id": "subj",
            "Attribute": [
                {
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:subject:subject-id",
                    "Value": "uid_1234567"
                },
                {
                    "AttributeId": "urn:mytest:testapp:xacml:subject:person-id",
                    "Value": "person_456454345234353"
                },
                {
                    "AttributeId": "urn:mytest:testapp:xacml:subject:permissions:LessonOperationsOnMyOwnUots-enabled",
                    "DataType": "boolean",
                    "Value": true
                }
            ]
        },

        "Action": {
            "Id": "act-01",
            "Attribute": [
                {
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "Courses.CreateLesson"
                }
            ]
        },

        "MultiRequests": {
            "RequestReference": [
                {
                    "ReferenceId": ["res-01","act-01","subj"]
                },
                {
                    "ReferenceId": ["res-02","act-01","subj"]
                }
            ]
        }       
    }
}  

Answer 1

根据您的测试，简短的答案是“否”，不是。

我已针对公理政策服务器测试了您的XACML请求，并且工作正常。 这是JSON格式的响应：

{
    "Response":[
        {
            "Decision":"NotApplicable",
            "Status":{
                "StatusCode":{
                    "Value":"urn:oasis:names:tc:xacml:1.0:status:ok",
                    "StatusCode":{
                        "Value":"urn:oasis:names:tc:xacml:1.0:status:ok"
                    }
                }
            },
            "PolicyIdentifierList":{

            }
        },
        {
            "Decision":"NotApplicable",
            "Status":{
                "StatusCode":{
                    "Value":"urn:oasis:names:tc:xacml:1.0:status:ok",
                    "StatusCode":{
                        "Value":"urn:oasis:names:tc:xacml:1.0:status:ok"
                    }
                }
            },
            "PolicyIdentifierList":{

            }
        }
    ]
}