这是一个很好的问题,我很高兴看到你也在使用 ALFA。让我对此有所了解。
请求
首先,在 XACML 请求中,将属性作为两个单独的属性发送与将其作为单个属性发送相同。例如,以下两个请求是相同的。
也是员工的客户 Alice 可以查看保险单 123 吗?
请求示例 1
<?xml version="1.0" encoding="UTF-8"?><xacml-ctx:Request ReturnPolicyIdList="true" CombinedDecision="false" xmlns:xacml-ctx="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" >
<xacml-ctx:Attribute AttributeId="com.axiomatics.user.type" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">customer</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
<xacml-ctx:Attribute AttributeId="com.axiomatics.user.type" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">employee</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
<xacml-ctx:Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">alice</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
</xacml-ctx:Attributes>
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" >
<xacml-ctx:Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">view</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
</xacml-ctx:Attributes>
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" >
<xacml-ctx:Attribute AttributeId="com.axiomatics.resource.type" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">insurance policy</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
<xacml-ctx:Attribute AttributeId="com.axiomatics.policy.polId" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">123</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
</xacml-ctx:Attributes>
</xacml-ctx:Request>
请求示例 2
<?xml version="1.0" encoding="UTF-8"?><xacml-ctx:Request ReturnPolicyIdList="true" CombinedDecision="false" xmlns:xacml-ctx="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" >
<xacml-ctx:Attribute AttributeId="com.axiomatics.user.type" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">customer</xacml-ctx:AttributeValue>
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">employee</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
<xacml-ctx:Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">alice</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
</xacml-ctx:Attributes>
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" >
<xacml-ctx:Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">view</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
</xacml-ctx:Attributes>
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" >
<xacml-ctx:Attribute AttributeId="com.axiomatics.resource.type" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">insurance policy</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
<xacml-ctx:Attribute AttributeId="com.axiomatics.policy.polId" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">123</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
</xacml-ctx:Attributes>
</xacml-ctx:Request>
属性是包
在 XACML 中,属性始终是包。即使它包含零或一个值,它也始终是多值的。这意味着如果你想对属性进行操作,你需要记住它是一个包。例如,如果您想将市场与切片连接起来,您要么必须将其转换为单个值(并且仅在它确实是单个值时才有效)或使用高阶函数。高阶函数是将另一个函数作为参数的函数,例如 AllOf。
连接多值属性
一个选项是使用 stringConcatenate 但该函数仅对原子值进行操作。您可以使用 map 将其应用于一个包,但不幸的是,在您的情况下,您需要一个能够处理多个包的地图。
解决方案:使用多个决策请求
您可以使用多决策配置文件(MDP),而不是在一次请求中发送所有值,它可以让您一次性发送多个请求,例如:
Alice 可以查看、编辑、删除记录 1、2、3 吗?
答案将包含与组合乘积一样多的决策(在本例中为 1x3x3)。
在您的情况下,您会将所有决定合并为一个。If all Permit then Permit else Deny。MDP中有一个参数可以做到这一点。它被称为CombinedDecision。
考虑到这一点,政策如下所示(使用ALFA表示法):
namespace com.axiomatics{
attribute product{
category = resourceCat
id = "product"
type = string
}
attribute market{
category = resourceCat
id = "market"
type = string
}
attribute slice{
category = resourceCat
id = "slice"
type = string
}
attribute productMarketSliceAccess{
category = subjectCat
id = "product-market-slice-access"
type = string
}
policy userAccessProductMarketSlice{
apply firstApplicable
rule allowAccess{
permit
condition stringIsIn(stringOneAndOnly(product)+
stringOneAndOnly(market)+
stringOneAndOnly(slice),productMarketSliceAccess)
}
}
}
样品申请 - MDP
{
"Request": {
"CombinedDecision": true,
"AccessSubject": {
"Attribute": [
{
"AttributeId": "product-market-slice-access",
"Value": "BAC"
},
{
"AttributeId": "product-market-slice-access",
"Value": "DEF"
}
]
},
"Resource": [{
"Attribute": [
{
"AttributeId": "market",
"Value": "A"
},
{
"AttributeId": "product",
"Value": "B"
},
{
"AttributeId": "slice",
"Value": "C"
}
]
},{
"Attribute": [
{
"AttributeId": "market",
"Value": "E"
},
{
"AttributeId": "product",
"Value": "D"
},
{
"AttributeId": "slice",
"Value": "F"
}
]
}],
"Action": {
"Attribute": []
},
"Environment": {
"Attribute": []
}
}
}