Question

行李的XACML类型是什么？

我的条件函数是string-at-least-one-member-of，我在请求中使用string-bag函数。我为行李提供了DataType的数据类型AttributeDesignator？

我的条件是：

     <xacml3:Condition>
        <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
           <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:county" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator>
           <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:counties" DataType="WHAT SHOULD THIS BE?" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" MustBePresent="false"></xacml3:AttributeDesignator>
        </xacml3:Apply>
     </xacml3:Condition>

我的属性是

    <xacml3:Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
        <xacml3:Attribute AttributeId="test:xacml:1.0:counties" IncludeInResult="false">
          <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
            <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</xacml3:AttributeValue>
            <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">brazoria</xacml3:AttributeValue>
            <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dallas</xacml3:AttributeValue>
          </xacml3:Apply>
        </xacml3:Attribute>
    </xacml3:Attributes>

当我在WSO2中尝试请求时，我得到了

<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
    <Result>
        <Decision>Deny</Decision>
        <Status>
            <StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/>
        </Status>
    </Result>
</Response>

对于那些对整个文件感兴趣的人，我的要求是：

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="true">
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
    <Attribute AttributeId="test:xacml:1.0:county" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue>
    </Attribute>
</Attributes>
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
    <Attribute AttributeId="test:xacml:1.0:counties" IncludeInResult="true">
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue>
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">brazoria</AttributeValue>
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dallas</AttributeValue>
      </Apply>
    </Attribute>
</Attributes>
</Request>

我的政策是：

<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"  PolicyId="county-based-3" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
  <xacml3:Description></xacml3:Description>
  <xacml3:Target></xacml3:Target>
  <xacml3:Rule Effect="Permit" RuleId="http://axiomatics.com/alfa/identifier/stackoverflow.example.checkGroup">
     <xacml3:Description></xacml3:Description>
     <xacml3:Target></xacml3:Target>
     <xacml3:Condition>
        <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
           <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:county" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator>
           <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:counties" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" MustBePresent="false"></xacml3:AttributeDesignator>
        </xacml3:Apply>
     </xacml3:Condition>
  </xacml3:Rule> 
  <xacml3:Rule Effect="Deny" RuleId="deny-rule"></xacml3:Rule>

Answer 1

数据类型应为http://www.w3.org/2001/XMLSchema#string：

        <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
       <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:county" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator>
       <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:counties" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" MustBePresent="false"></xacml3:AttributeDesignator>
    </xacml3:Apply>

所有属性指示符实际上都是XACML中的包。数据类型适用于包的整个元素。

此外，您使用函数urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of，其中包含XACML 3.0 specification中定义的2个字符串：

urn:oasis:names:tc:xacml:x.x:function:type-at-least-one-member-of


这个函数应该带两个参数，它们都是'type'的包   值。它应返回“http://www.w3.org/2001/XMLSchema#boolean”。   该函数应评估为＆＃34; True＆＃34;当且仅当至少有一个   第一个参数的元素包含在第二个参数中   由＆＃34; urn：oasis确定：名称：tc：xacml：x.x：function：type-is-in＆＃34;。

您发送的请求无效。 <Request/>元素内部不能包含<Apply/>元素。

删除<Apply/>，您应该收到以下请求：

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="true">
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
    <Attribute AttributeId="test:xacml:1.0:county" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue>
    </Attribute>
</Attributes>
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
    <Attribute AttributeId="test:xacml:1.0:counties" IncludeInResult="true">

        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue>
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">brazoria</AttributeValue>
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dallas</AttributeValue>

    </Attribute>
</Attributes>
</Request>

这是Axiomatics Policy Server中的图形表示：

Axiomatics Policy Server - Request Editor

袋子的XACML类型

1 个答案: