多個決策檔案政策3.0

我要求寫一個政策，針對特定用戶將返回這樣的XACML響應：多個決策檔案政策3.0

這項政策是基於單個用戶：鮑勃

FirstName: Create= true , Read = true, Update = true, Delete = false 
MiddleName: Create= true , Read = true, Update = true, Delete = false 
LastName: Create= true , Read = true, Update = true, Delete = false

如何爲這樣的需求編寫一個xacml策略，以及該請求對於同一策略的外觀。

如何使用Axiomatics Alfa插件和WSO2身份服務器實現此策略。

來源

2014-01-22 Utsav

您想要檢索用戶bob的允許操作嗎？什麼是「FirstName，MiddleName，LastName」是什麼意思？你能解釋更多嗎？然後我希望，我們可以提供更好的答案。 – Asela

BOB是系統中的用戶，名字：BOB，MiddleName：PETER，姓：MATHEW，所以在這裏我需要發送一個請求給用戶bob，他允許訪問什麼資源，假設bob可以讀取FirstName但是他不能寫我的意思是說他不能更新他的名字，所以我想返回這些值作爲名字的響應：Create = false，Read = true，Update = false，Delete = false。 – Utsav

爲了更好的理解，我還有另外一個場景可以實現，假設我有三個屬性，比如1. Name 2. Age 3. DOB。當用戶在認證後登錄應用程序時，我們啓動授權過程。因此，用戶只能授權訪問這些屬性，如：Name：{Read = true，Write =「false」}，Age：{Read = true，Write = false}，DOB：{Read = true，Write = false}。所以我想要像這樣實現xacml響應。爲此，政策結構看起來像我不知道的。 – Utsav

我們得到如下......這項政策是基於單個用戶鮑勃

FirstName: Create= true , Read = true, Update = true, Delete = false 
MiddleName: Create= true , Read = true, Update = false, Delete = false 
LastName: Create= false , Read = true, Update = false, Delete = false

以下是政策，政策是基於用戶（「鮑勃」）。因此，我們可以將用戶名稱作爲策略目標，並可以創建三條規則。在規則中，「FirstName」，「MiddleName」和「LastName」被視爲資源，對於每個資源，規則已經創建。

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="NamePolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"> 
    <Target> 
     <AnyOf> 
     <AllOf> 
      <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">bob</AttributeValue> 
       <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator> 
      </Match> 
     </AllOf> 
     </AnyOf> 
    </Target> 
    <Rule Effect="Permit" RuleId="Rule-1"> 
     <Target> 
     <AnyOf> 
      <AllOf> 
       <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">FirstName</AttributeValue> 
        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator> 
       </Match> 
      </AllOf> 
     </AnyOf> 
     </Target> 
     <Condition> 
     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"> 
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">create</AttributeValue> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">update</AttributeValue> 
      </Apply> 
      <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator> 
     </Apply> 
     </Condition> 
    </Rule> 
    <Rule Effect="Permit" RuleId="Rule-2"> 
     <Target> 
     <AnyOf> 
      <AllOf> 
       <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">MiddleName</AttributeValue> 
        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator> 
       </Match> 
      </AllOf> 
     </AnyOf> 
     </Target> 
     <Condition> 
     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"> 
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">create</AttributeValue> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue> 
      </Apply> 
      <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator> 
     </Apply> 
     </Condition> 
    </Rule> 
    <Rule Effect="Permit" RuleId="Rule-3"> 
     <Target> 
     <AnyOf> 
      <AllOf> 
       <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">LastName</AttributeValue> 
        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator> 
       </Match> 
      </AllOf> 
     </AnyOf> 
     <AnyOf> 
      <AllOf> 
       <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue> 
        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator> 
       </Match> 
      </AllOf> 
     </AnyOf> 
     </Target> 
    </Rule> 
    <Rule Effect="Deny" RuleId="Rule-4"></Rule> 
</Policy>

以下是您可以試用的XACML multiple decision profile請求。在這裏，您可以更改資源值並查看每個資源的授權。它會返回允許「bob」允許的動作的結果

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false"> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="false"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">LastName</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" IncludeInResult="false"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">bob</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">create</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">update</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">delete</AttributeValue> 
     </Attribute> 
    </Attributes> 
</Request> 
<?xml version="1.0" encoding="UTF-8"?> 
<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false"> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="false"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">LastName</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" IncludeInResult="false"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">bob</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">create</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">update</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">delete</AttributeValue> 
     </Attribute> 
    </Attributes> 
</Request>

來源

2014-01-23 16:36:33 Asela

感謝Asela一次爲一個資源工作，但是當我發送多個資源的請求時，它顯示出「不確定」。 – Utsav

您是否設法解決您的問題，Timon？是否因爲你勾選了「CombinedDecision」選項？ –

多個決策檔案政策3.0

回答

相關問題