Question

我在我的java应用程序中使用XalaML 3.0和Balana。我的XML模式定义如下：

<record>
    <proposal>
            <proposalid></proposalid>
            <proposaltitle></proposaltitle>
            <pi>
                <fullname></fullname>
                <workemail></workemail>
                <userid></userid>
            </pi>
            <copis>
                <copi>
                    <fullname></fullname>
                    <workemail></workemail>
                    <userid></userid>
                </copi>
                <copi>
                    <fullname></fullname>
                    <workemail></workemail>
                    <userid></userid>
                </copi>
                <copi>
                    <firstname></firstname>
                    <lastname></lastname>
                    <workemail></workemail>
                    <userid></userid>
                </copi>
            </copis>                
        </proposal>
    </record>

我的应用程序向PEP发送XACML请求，如下所示：

<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:proposal.role" IncludeInResult="false">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">PI</AttributeValue>
    </Attribute>
  </Attributes>
  <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
    <Content>
      <ak:record xmlns:ak="http://akpower.org">
        <ak:proposal>
          <ak:proposalid>5702a60865dbb30b09a492cf</ak:proposalid>
          <ak:proposaltitle>Proposal 11</ak:proposaltitle>
          <ak:authorprofile>
            <ak:fullname>Milson Munakami</ak:fullname>
          </ak:authorprofile>
          <ak:pi>
            <ak:fullname>Milson Munakami</ak:fullname>
            <ak:workemail>milsonmun@yahoo.com</ak:workemail>
            <ak:userid>56fee3e965dbb35ce5c900fa</ak:userid>
          </ak:pi>
          <ak:copis>
            <ak:copi>
              <ak:fullname>PS Wang</ak:fullname>
              <ak:workemail>fdsafda@yahoo.comss</ak:workemail>
              <ak:userid>56fee3e965dbb35ce5c900fx</ak:userid>
            </ak:copi>
            <ak:copi>
              <ak:fullname>Thomas Voltz</ak:fullname>
              <ak:workemail>fdsafda@yahoo.comsss</ak:workemail>
              <ak:userid>56fee3e965dbb35ce5c900fx</ak:userid>
            </ak:copi>
          </ak:copis>
        </ak:proposal>
      </ak:record>
    </Content>
    <Attribute AttributeId="urn:oasis:names:tc:xacml:3.0:content-selector" IncludeInResult="false">
      <AttributeValue XPathCategory="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="urn:oasis:names:tc:xacml:3.0:data-type:xpathExpression">//ak:record/ak:proposal</AttributeValue>
    </Attribute>
    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:DeletedByPI" IncludeInResult="false">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">NOTDELETED</AttributeValue>
    </Attribute>
    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:proposal.section" IncludeInResult="false">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Whole Proposal</AttributeValue>
    </Attribute>
    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:SubmittedByPI" IncludeInResult="false">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">NOTSUBMITTED</AttributeValue>
    </Attribute>
  </Attributes>
  <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action">
    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:proposal.action" IncludeInResult="false">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Save</AttributeValue>
    </Attribute>
  </Attributes>
</Request>

在我的政策规则中，我有：

<ObligationExpressions>
      <ObligationExpression ObligationId="sendEmail" FulfillOn="Permit">
        <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Your proposal has been updated. As soon as possible please review your proposal for any unwanted changes</AttributeValue>
        </AttributeAssignmentExpression>
        <AttributeAssignmentExpression AttributeId="piEmail">
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
            <AttributeSelector MustBePresent="false"
              ContextSelectorId="urn:oasis:names:tc:xacml:3.0:content-selector"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              Path="//ak:pi/ak:workemail/text()" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </Apply>
        </AttributeAssignmentExpression>        
        <AttributeAssignmentExpression AttributeId="piFullName">
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
            <AttributeSelector MustBePresent="false"
              ContextSelectorId="urn:oasis:names:tc:xacml:3.0:content-selector"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              Path="//ak:pi/ak:fullname/text()" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </Apply>
        </AttributeAssignmentExpression>
        <AttributeAssignmentExpression AttributeId="coPisEmail">
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
            <AttributeSelector MustBePresent="false"
              ContextSelectorId="urn:oasis:names:tc:xacml:3.0:content-selector"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              Path="//ak:copis/ak:copi/ak:workemail/text()" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </Apply>
        </AttributeAssignmentExpression>        
        <AttributeAssignmentExpression AttributeId="coPisFullName">
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
            <AttributeSelector MustBePresent="false"
              ContextSelectorId="urn:oasis:names:tc:xacml:3.0:content-selector"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              Path="//ak:copis/ak:copi/ak:fullname/text()" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </Apply>
        </AttributeAssignmentExpression>
      </ObligationExpression>
    </ObligationExpressions>

我的回答如下：

<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
  <Result>
    <Decision>Permit</Decision>
    <Status>
      <StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/>
    </Status>
    <Obligations>
      <Obligation ObligationId="sendEmail">
        <AttributeAssignment  AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text" DataType="http://www.w3.org/2001/XMLSchema#string">
          Your proposal has been updated. As soon as possible please review your proposal for any unwanted changes
        </AttributeAssignment>
        <AttributeAssignment  AttributeId="piEmail" DataType="http://www.w3.org/2001/XMLSchema#string">
          milsonmun@yahoo.com
        </AttributeAssignment>
        <AttributeAssignment  AttributeId="piFullName" DataType="http://www.w3.org/2001/XMLSchema#string">
          Milson Munakami
        </AttributeAssignment>
      </Obligation>
    </Obligations>
  </Result>
</Response>

这并不包含coPisEmail和coPisFullName的任何义务值。此外，我不知道如何抓住这些动态属性＆＃39;值？我怎样才能在我的应用程序中使用这些值？例如，它只返回一个带有所有电子邮件和全名的值，还是会在单独的响应中返回单个值？我想我在这里缺少一些东西：

<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:**function:string-one-and-only**">
            <AttributeSelector MustBePresent="false"
              ContextSelectorId="urn:oasis:names:tc:xacml:3.0**:content-selector**"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              Path="//ak:pi/ak:workemail/text()" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </Apply>

Answer 1

在XACML中没有什么特别的东西可以用来返回多个值。默认情况下，所有属性都是包。如果PDP为给定的表达式（属性指示符或属性选择器）找到多个值，那么它将返回所有这些值。

另外，作为最佳做法，尽量避免在XACML策略中使用XPath，因为这会使它们更难理解。 XML处理应该在PEP或PIP内完成，XACML策略应该尽可能保持业务。

如何使用XACML在我的Obligation Expression中返回多个属性值？

1 个答案: