Question

我正在制定XACML政策，并且我正在使用sun.xacml库。我想比较两个属性：一个用于主题，一个用于资源以允许访问资源。

我已经生成了这个XACML文件

＆＃13;

<?xml version="1.0"?>
<Policy PolicyId="GeneratedPolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides">
  <Description>Policy che permette la lettura del file ai client che hanno un livello di permesso maggiore o uguale al livello di permesso del file richiesto</Description>
  <Target>
<Subjects>
  <AnySubject/>
</Subjects>
<Resources>
  <AnyResource/>
</Resources>
<Actions>
  <Action>
	<ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
	  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
	  <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
	</ActionMatch>
  </Action>
</Actions>
  </Target>
  <Rule RuleId="canRead" Effect="Permit">
<Target>
  <Subjects>
	<AnySubject/>
  </Subjects>
  <Resources>
	<AnyResource/>
  </Resources>
  <Actions>
	<Action>
	  <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
		<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
		<ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
	  </ActionMatch>
	</Action>
  </Actions>
</Target>
<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-greater-than-or-equal">
  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
	<SubjectAttributeDesignator AttributeId="level-permission" DataType="http://www.w3.org/2001/XMLSchema#string"/>
  </Apply>
  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">4</AttributeValue>
</Condition>
  </Rule>
  <Rule RuleId="FinalRule" Effect="Deny"/>
</Policy>

＆＃13;

问题在于资源具有级别权限，我想比较主题级别权限和资源级别权限，但我不知道该怎么做。

非常感谢

Answer 1

你快到了。每当您需要将2个属性进行比较时，例如user-clearance和resource-classification，您需要使用XACML Condition。您确实尝试在示例中执行此操作，但您将属性与静态值进行了比较。

以下是ALFA（Axiomatics Language for Authorization）中的一个简单示例。

policy documentAccess{
    apply firstApplicable
    rule allowAccessIfClearanceSufficient{
        condition user.clearance>document.classification
        permit
    }
}

我按如下方式定义我的属性：

    attribute classification{
        category = resourceCat
        id = "document.classification"
        type = integer
    }

和

    attribute clearance{
        category = subjectCat
        id = "user.clearance"
        type = integer
    }

请注意，我在这里使用整数而不是字符串。它更有效，更安全。

XACML 3.0中的输出如下：

<?xml version="1.0" encoding="UTF-8"?>
 <!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). 
 Any modification to this file will be lost upon recompilation of the source ALFA file-->
<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="http://axiomatics.com/alfa/identifier/example.documentAccess"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
    Version="1.0">
    <xacml3:Description />
    <xacml3:PolicyDefaults>
        <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
    </xacml3:PolicyDefaults>
    <xacml3:Target />
    <xacml3:Rule 
            Effect="Permit"
            RuleId="http://axiomatics.com/alfa/identifier/example.documentAccess.allowAccessIfClearanceSufficient">
        <xacml3:Description />
        <xacml3:Target />
        <xacml3:Condition>
            <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of-any">
                <xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-greater-than"/>
                <xacml3:AttributeDesignator 
                    AttributeId="user.clearance"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                    MustBePresent="false"
                />
                <xacml3:AttributeDesignator 
                    AttributeId="document.classification"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                    MustBePresent="false"
                />
            </xacml3:Apply>
        </xacml3:Condition>
    </xacml3:Rule>
</xacml3:Policy>

比较XACML策略中的属性

1 个答案: