Question

I would like to get some help with a ABAC, XACML project i have, where i'm trying to get a request and response back from the server, while talking to it through a PHP script as seen below.

<?php 
$postdata = '<xacml-ctx:Request ReturnPolicyIdList="true" CombinedDecision="true"  xmlns:xacml-ctx="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
 <xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" >
 <xacml-ctx:Attribute AttributeId="http://www.axiomatics.com/acs/role" IncludeInResult="true">
 <xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Jimi</xacml-ctx:AttributeValue>
  </xacml-ctx:Attribute>
 </xacml-ctx:Attributes>
 <xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" >
  <xacml-ctx:Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true">
     <xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">view</xacml-ctx:AttributeValue>
  </xacml-ctx:Attribute>
</xacml-ctx:Attributes>
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" >
</xacml-ctx:Attributes>
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" >
  <xacml-ctx:Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="true">
     <xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">bank account</xacml-ctx:AttributeValue>
  </xacml-ctx:Attribute>
 </xacml-ctx:Attributes>
</xacml-ctx:Request>';

This part is the request, the policy that i have stored in de Policy Administration Point is the following:

$ch = curl_init();
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-type:     application/xml'));
curl_setopt($ch, CURLOPT_URL, 'http://localhost:8080/pdp/?type=config');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$data = curl_exec($ch);
curl_close($ch);

echo $data;


    <xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="http://www.axiomatics.com/automatic-unique-id/5ec8c01d-456c-4800-b28b-ad3d289ecba3" Version="1.0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-unless-permit">
    <xacml3:PolicyDefaults><xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion></xacml3:PolicyDefaults>
      <xacml3:Target>
        <xacml3:AnyOf>
          <xacml3:AllOf>
            <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
              <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">bank account</xacml3:AttributeValue>
              <xacml3:AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"  AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
            </xacml3:Match>
            <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
              <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">view</xacml3:AttributeValue>
              <xacml3:AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"  AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
            </xacml3:Match>
            <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
              <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Jimi</xacml3:AttributeValue>
              <xacml3:AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"  AttributeId="http://www.axiomatics.com/acs/role" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
            </xacml3:Match>
          </xacml3:AllOf>
        </xacml3:AnyOf>
      </xacml3:Target>
      <xacml3:Rule RuleId="51179cb3-5319-4a35-a13e-ac1db27b5d93" Effect="Permit">
        <xacml3:Description>doctor can view medicalrecord</xacml3:Description>
        <xacml3:Target/>
      </xacml3:Rule>
      <xacml3:Rule RuleId="a2af1648-41c0-4843-ba4f-c1284d367957" Effect="Deny">
        <xacml3:Target/>
      </xacml3:Rule>
    </xacml3:Policy>

The original request was with the name "teller". Whenever i change the name in teller the system will respond with: "permit". Now my problem is, is when i change the name in the policy that is stored in the PAP, and in the php script to "jimi". I get the following error:

<?xml version="1.0" encoding="UTF-8"?>
<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17 http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd">
    <Result>
        <Decision>Indeterminate</Decision>
        <Status>
            <StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:processing-error"/>
            <StatusMessage>No matching root policy found</StatusMessage>
        </Status>
    </Result>
</Response>

Whenever i change the policy, i dont get a "deny", but a no matching root policy. While i clearly changed the name in the policy to mine.. What am i doing wrong here? Where else could the name teller still be named instead of my name?

Answer 1

您的政策

我使用Axiomatics政策编辑检查了您的政策，这是回来的：

我的第一条评论是您应该为所有政策添加说明。您可以在此处看到，您有一个策略，其中包含deny-unless-permit的组合算法。该策略包含Permit规则和Deny规则。

现在，如果我们检查父策略，我们可以看到有一个目标集。目标指出，如果传入用户的角色是Jimi在资源ID银行帐户上执行操作视图，则该策略将适用。鉴于政策内部的第一条规则涉及医生和医疗记录，这是没有意义的。似乎规则的描述是旧的，因为规则的目标是空的。而且，按照你的方式拥有2条空规则是没有意义的。你需要解决这个问题

您的要求

我将您的第一个请求加载到Axiomatics Simulation工具中并得到了这个：

如果我运行请求，则会获得允许。

现在，如果我将请求更改为用户teller而不是Jimi，那么我会获得NotApplicable。

您使用的是哪种PDP？获得不确定性不符合规范。

XACML issue with editing policy

1 个答案:

您的政策

您的要求