Type XACML pour sacs

Question

Quel est le type XACML pour un sac?

Ma fonction de condition est string-at-least-one-member-of, et j'utilise la fonction string-bag dans ma demande. Quel type de données DataType dois-je donner le AttributeDesignator pour le sac?

Ma condition est:

 <xacml3:Condition> 
     <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"> 
      <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:county" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator> 
      <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:counties" DataType="WHAT SHOULD THIS BE?" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" MustBePresent="false"></xacml3:AttributeDesignator> 
     </xacml3:Apply> 
    </xacml3:Condition> 

et mon attribut est

<xacml3:Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
     <xacml3:Attribute AttributeId="test:xacml:1.0:counties" IncludeInResult="false"> 
      <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"> 
      <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</xacml3:AttributeValue> 
      <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">brazoria</xacml3:AttributeValue> 
      <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dallas</xacml3:AttributeValue> 
      </xacml3:Apply> 
     </xacml3:Attribute> 
    </xacml3:Attributes> 

Lorsque je tente la demande WSO2, je reçois

<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"> 
    <Result> 
     <Decision>Deny</Decision> 
     <Status> 
      <StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/> 
     </Status> 
    </Result> 
</Response> 

Pour ceux intéressés par les fichiers entiers , ma demande est:

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="true"> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
    <Attribute AttributeId="test:xacml:1.0:county" IncludeInResult="true"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue> 
    </Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
    <Attribute AttributeId="test:xacml:1.0:counties" IncludeInResult="true"> 
     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">brazoria</AttributeValue> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dallas</AttributeValue> 
     </Apply> 
    </Attribute> 
</Attributes> 
</Request> 

et ma politique est:

<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="county-based-3" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"> 
    <xacml3:Description></xacml3:Description> 
    <xacml3:Target></xacml3:Target> 
    <xacml3:Rule Effect="Permit" RuleId="http://axiomatics.com/alfa/identifier/stackoverflow.example.checkGroup"> 
    <xacml3:Description></xacml3:Description> 
    <xacml3:Target></xacml3:Target> 
    <xacml3:Condition> 
     <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"> 
      <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:county" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator> 
      <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:counties" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" MustBePresent="false"></xacml3:AttributeDesignator> 
     </xacml3:Apply> 
    </xacml3:Condition> 
    </xacml3:Rule> 
    <xacml3:Rule Effect="Deny" RuleId="deny-rule"></xacml3:Rule> 

Answer 1

Le type de données doit être http://www.w3.org/2001/XMLSchema#string:

 <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"> 
     <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:county" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator> 
     <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:counties" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" MustBePresent="false"></xacml3:AttributeDesignator> 
    </xacml3:Apply> 

Tous les désignateurs d'attributs sont dans des sacs faits en XACML. Le type de données s'applique à l'ensemble des éléments du sac.

De plus, vous utilisez la fonction urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of qui prend 2 sacs de cordes tel que défini dans le XACML 3.0 specification:

• urn:oasis:names:tc:xacml:x.x:function:type-at-least-one-member-of

Cette fonction prendra deux arguments qui sont à la fois sac de 'type' valeurs . Il DEVRA retourner un "http://www.w3.org/2001/XMLSchema#boolean". La fonction DEVRA évaluer à "Vrai" si et seulement si au moins un élément du premier argument est contenu dans le deuxième argument comme déterminé par "urn: oasis: noms: tc: xacml: xx: fonction: type-est -dans".

La demande que vous avez reçue n'est pas valide. Un élément <Request/> ne peut pas contenir un élément <Apply/> à l'intérieur.

Retirez <Apply/> et vous devriez obtenir la demande suivante:

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="true"> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
    <Attribute AttributeId="test:xacml:1.0:county" IncludeInResult="true"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue> 
    </Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
    <Attribute AttributeId="test:xacml:1.0:counties" IncludeInResult="true"> 

     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">brazoria</AttributeValue> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dallas</AttributeValue> 

    </Attribute> 
</Attributes> 
</Request> 

Ceci est la représentation graphique dans le serveur de stratégie Axiomatique: