Question

我希望如果请求者和策略所有者在同一个房间（这里的位置是动态属性），那么请求者将获得对资源的访问权限。如何在XACML策略中编写它？

Answer 1

您可以使用XACML条件实现您想要做的事情。

Axiomatics Question of the Week系列有一篇关于此主题的文章，您可以阅读here。

根据条件，您可以实施关系。在您的情况下，这种关系将比较请求者的位置和策略所有者的位置。

在ALFA中，您的政策可能如下所示：

policy allow{
    apply firstApplicable
    rule allow{
        permit
        condition requesterLocation == policyOwnerLocation
    }
}

这将生成以下XML：

<?xml version="1.0" encoding="UTF-8"?>
 <!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). 
 Any modification to this file will be lost upon recompilation of the source ALFA file-->
<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="http://axiomatics.com/alfa/identifier/example.allow"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
    Version="1.0">
    <xacml3:Description />
    <xacml3:PolicyDefaults>
        <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
    </xacml3:PolicyDefaults>
    <xacml3:Target />
    <xacml3:Rule 
            Effect="Permit"
            RuleId="http://axiomatics.com/alfa/identifier/example.allow.allow">
        <xacml3:Description />
        <xacml3:Target />
        <xacml3:Condition>
            <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of-any">
                <xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
                <xacml3:AttributeDesignator 
                    AttributeId="com.axiomatics.example.requesterLocation"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                    MustBePresent="false"
                />
                <xacml3:AttributeDesignator 
                    AttributeId="com.axiomatics.example.policyOwnerLocation"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                    MustBePresent="false"
                />
            </xacml3:Apply>
        </xacml3:Condition>
    </xacml3:Rule>
</xacml3:Policy>

动态属性的XACML策略

1 个答案: