0

包的 XACML 类型是什么？

我的条件函数是string-at-least-one-member-of，我string-bag在我的请求中使用该函数。DataType我为包提供什么数据类型AttributeDesignator？

我的条件是：

     <xacml3:Condition>
        <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
           <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:county" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator>
           <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:counties" DataType="WHAT SHOULD THIS BE?" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" MustBePresent="false"></xacml3:AttributeDesignator>
        </xacml3:Apply>
     </xacml3:Condition>

我的属性是

    <xacml3:Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
        <xacml3:Attribute AttributeId="test:xacml:1.0:counties" IncludeInResult="false">
          <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
            <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</xacml3:AttributeValue>
            <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">brazoria</xacml3:AttributeValue>
            <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dallas</xacml3:AttributeValue>
          </xacml3:Apply>
        </xacml3:Attribute>
    </xacml3:Attributes>

当我在 WSO2 中尝试请求时，我得到

<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
    <Result>
        <Decision>Deny</Decision>
        <Status>
            <StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/>
        </Status>
    </Result>
</Response>

对于那些对整个文件感兴趣的人，我的要求是：

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="true">
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
    <Attribute AttributeId="test:xacml:1.0:county" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue>
    </Attribute>
</Attributes>
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
    <Attribute AttributeId="test:xacml:1.0:counties" IncludeInResult="true">
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue>
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">brazoria</AttributeValue>
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dallas</AttributeValue>
      </Apply>
    </Attribute>
</Attributes>
</Request>

我的政策是：

<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"  PolicyId="county-based-3" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
  <xacml3:Description></xacml3:Description>
  <xacml3:Target></xacml3:Target>
  <xacml3:Rule Effect="Permit" RuleId="http://axiomatics.com/alfa/identifier/stackoverflow.example.checkGroup">
     <xacml3:Description></xacml3:Description>
     <xacml3:Target></xacml3:Target>
     <xacml3:Condition>
        <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
           <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:county" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator>
           <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:counties" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" MustBePresent="false"></xacml3:AttributeDesignator>
        </xacml3:Apply>
     </xacml3:Condition>
  </xacml3:Rule> 
  <xacml3:Rule Effect="Deny" RuleId="deny-rule"></xacml3:Rule>

4

1 回答 1

3

数据类型应为http://www.w3.org/2001/XMLSchema#string：

        <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
       <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:county" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator>
       <xacml3:AttributeDesignator AttributeId="test:xacml:1.0:counties" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" MustBePresent="false"></xacml3:AttributeDesignator>
    </xacml3:Apply>

所有属性指示符实际上都是 XACML 中的包。数据类型适用于包的所有元素。

此外，您使用的函数采用 XACML 3.0规范urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of中定义的 2 袋字符串：

  • urn:oasis:names:tc:xacml:x.x:function:type-at-least-one-member-of

此函数应采用两个参数，它们都是一袋“类型”值。它应返回“<a href="http://www.w3.org/2001/XMLSchema#boolean" rel="nofollow noreferrer">http://www.w3.org/2001/XMLSchema#boolean”。当且仅当由“urn:oasis:names:tc:xacml:xx:function:type-is-in”确定的第二个参数中包含第一个参数的至少一个元素时，函数应评估为“True” .

您发送的请求无效。一个元素里面<Request/>不能包含一个<Apply/>元素。

删除<Apply/>，您应该收到以下请求：

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="true">
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
    <Attribute AttributeId="test:xacml:1.0:county" IncludeInResult="true">
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue>
    </Attribute>
</Attributes>
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
    <Attribute AttributeId="test:xacml:1.0:counties" IncludeInResult="true">

        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">travis</AttributeValue>
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">brazoria</AttributeValue>
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dallas</AttributeValue>

    </Attribute>
</Attributes>
</Request>

这是 Axiomatics Policy Server 中的图形表示：

Axiomatics Policy Server - 请求编辑器

于 2014-06-25T08:29:36.790 回答