基於用戶域的XACML策略

Question

您好我想創建一個基於域的策略，所以我想使用正則表達式：^（[a-zA-Z0-9 _.-]）+ \ @ mydomain.com。所以在這種情況下，我需要一個策略，任何屬於mydomain.com的用戶都可以根據規則訪問資源。政策格式如何。需要相同的幫助。

Answer 1

我創建並測試對我來說，基於其域檢查用戶和應用資源應用規則的正常工作政策：

策略格式：誰屬於域的用戶：@ mydomains.com和資源是名和姓。

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="domain3" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-overrides" Version="1.0"> 
    <Target> 
     <AnyOf> 
     <AllOf> 
      <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match"> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">^([a-zA-Z0-9_.-]) @mydomains.com</AttributeValue> 
       <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:environment-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
      </Match> 
     </AllOf> 
     </AnyOf> 
    </Target> 
    <Rule Effect="Permit" RuleId="Rule1"> 
     <Target> 
     <AnyOf> 
      <AllOf> 
       <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">firstname</AttributeValue> 
        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
       </Match> 
      </AllOf> 
      <AllOf> 
       <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">lastname</AttributeValue> 
        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
       </Match> 
      </AllOf> 
     </AnyOf> 
     </Target> 
     <Condition> 
     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or"> 
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
       <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"> 
        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
       </Apply> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">update</AttributeValue> 
      </Apply> 
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
       <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"> 
        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
       </Apply> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue> 
      </Apply> 
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
       <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only"> 
        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
       </Apply> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">create</AttributeValue> 
      </Apply> 
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in"> 
       <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">delete</AttributeValue> 
       <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
      </Apply> 
     </Apply> 
     </Condition> 
    </Rule> 
</Policy> 

請求格式：

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false"> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">firstname</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">lastname</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">create</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">update</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">delete</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:environment:environment-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">user@mydomains.com</AttributeValue> 
</Attribute> 
</Attributes> 
</Request>