xacml - 西飞箱包业务

Question

假设我们有一袋布尔值。是否有一个函数可以判断“真实”值的数量是否大于某个常数（例如，5）？

我遇到了“n-of”函数，但它需要多个单独的属性作为输入而不是袋子......也许“map”函数可以提供帮助，但不确定如何因为我没有找到可以减少的函数一个袋子里的物品数量。

谢谢！迈克尔。

Answer 1

要实现您正在寻找的东西，您需要使用两个功能：

• 测量袋子大小的函数，例如booleanBagSize(someAttribute)
• 检查袋子的每个值是否等于 true 的函数。例如booleanEquals与高阶函数结合使用，例如AllOf

ALFA 中的结果代码将是：

namespace axiomatics{
    attribute allowed{
        category = subjectCat
        id = "axiomatics.allowed"
        type = boolean
    }
    policy allowIf5True{
        apply firstApplicable
        rule allow{
            permit
            condition booleanBagSize(allowed)>5 && allOf(function[booleanEqual], true, allowed)
        }
    }
}

XACML 3.0 输出将是

<?xml version="1.0" encoding="UTF-8"?>
 <!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). 
 Any modification to this file will be lost upon recompilation of the source ALFA file-->
<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="http://axiomatics.com/alfa/identifier/axiomatics.allowIf5True"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
    Version="1.0">
    <xacml3:Description />
    <xacml3:PolicyDefaults>
        <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
    </xacml3:PolicyDefaults>
    <xacml3:Target />
    <xacml3:Rule 
            Effect="Permit"
            RuleId="http://axiomatics.com/alfa/identifier/axiomatics.allowIf5True.allow">
        <xacml3:Description />
        <xacml3:Target />
        <xacml3:Condition>
            <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-greater-than">
                    <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:boolean-bag-size" >
                        <xacml3:AttributeDesignator 
                            AttributeId="axiomatics.allowed"
                            DataType="http://www.w3.org/2001/XMLSchema#boolean"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            MustBePresent="false"
                        />
                    </xacml3:Apply>
                    <xacml3:AttributeValue
                        DataType="http://www.w3.org/2001/XMLSchema#integer">5</xacml3:AttributeValue>
                </xacml3:Apply>
                <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:all-of" >
                    <xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal"/>
                    <xacml3:AttributeValue
                        DataType="http://www.w3.org/2001/XMLSchema#boolean">true</xacml3:AttributeValue>
                    <xacml3:AttributeDesignator 
                        AttributeId="axiomatics.allowed"
                        DataType="http://www.w3.org/2001/XMLSchema#boolean"
                        Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                        MustBePresent="false"
                    />
                </xacml3:Apply>
            </xacml3:Apply>
        </xacml3:Condition>
    </xacml3:Rule>
</xacml3:Policy>

这种方法只有在包只包含真值时才有效。