如何理解XACML響應？

Question

我與以下政策一起工作，我無法理解XACML響應。 這我使用的政策是

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="TestPolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0"> 
<Target> 
<AnyOf> 
<AllOf> 
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">foo1</AttributeValue> 
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
</Match> 
</AllOf> 
<AllOf> 
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">foo2</AttributeValue> 
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
</Match> 
</AllOf> 
</AnyOf> 
</Target> 
<Rule Effect="Permit" RuleId="Rule-1"> 
<Condition> 
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and"> 
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"> 
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue> 
</Apply> 
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
</Apply> 
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"> 
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">bob1</AttributeValue> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">bob2</AttributeValue> 
</Apply> 
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/> 
</Apply> 
</Apply> 
</Condition> 
</Rule> 
<Rule Effect="Deny" RuleId="Deny-Rule"/> 
</Policy> 

這是我怎麼想提出一個XACML請求：

閱讀 寫 bob2 個 的index.jsp 後裔

ANG我得到了XACML響應，

<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"> 
<Result> 
<Decision>Permit</Decision> 
<Status><StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/> 
</Status> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">foo2</AttributeValue></Attribute> 
</Attributes><Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue></Attribute> 
</Attributes><Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">foo1</AttributeValue></Attribute> 
</Attributes></Result> 
<Result> 
<Decision>Permit</Decision> 
<Status><StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/> 
</Status> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue></Attribute> 
</Attributes><Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">foo2</AttributeValue></Attribute> 
</Attributes><Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue></Attribute> 
</Attributes></Result> 
<Result> 
<Decision>Permit</Decision> 
<Status><StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/> 
</Status> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue></Attribute> 
</Attributes><Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue></Attribute> 
</Attributes><Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">foo1</AttributeValue></Attribute> 
</Attributes></Result> 
<Result> 
<Decision>Permit</Decision> 
<Status><StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/> 
</Status> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue></Attribute> 
</Attributes><Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">foo1</AttributeValue></Attribute> 
</Attributes><Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="true"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">foo2</AttributeValue></Attribute> 
</Attributes></Result> 
</Response> 

從這個XACML響應我有4組結果決定爲證，

1. 第一個結果決定是許可證，這意味着s的foo1和foo2資源可以被用戶bob2讀取。
2. 第二個結果決定是許可證，這意味着foo2資源可以由用戶bob2讀取和寫入。
3. 第三個結果決定是許可證，這意味着foo1資源可以由用戶bob2讀取和寫入。
4. 第四個結果決定是許可證，這意味着foo1和foo2資源可以由用戶bob2寫入。 這是我從XACML響應中瞭解到的。你認爲我的理解是正確的嗎？如果沒有請指導我如何理解XACML響應。

Answer 1

我認爲，你與XACML 3.0試圖在多個決策輪廓。是的，你是對的。但是，您提供的XACML請求不是提供abovr結果的正確提示。因此更新它是很好的。通常，當使用多個決策配置文件時，您可以接收多個結果。作爲一個例子，您可以像您一樣對同一請求的讀寫操作授權。然後XACML響應包含兩個結果。我想你可以罰款約多個決策輪廓更多細節從here