WSO2身份服務器 - PAP

的嘗試，它根據與XACML V.3策略集的問題我想補充，以便使用目標，如果給定政策，規定運行的一系列序列政策設置的策略基於輸入字段「資源」是否適用。爲了開始測試，我編寫了一個包含一個策略的policySet。WSO2身份服務器 - PAP

由WSO2 PAP評估失敗，則會顯示的「NotApplicable的」一個結果，而我希望能收到「許可證」。

在這裏，在XML創建了一個名爲「cfatest0」政策：

<!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). Any modification to this file will be lost upon recompilation of the source ALFA file--> 
    <xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="cfatest0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-overrides" Version="1.0"> 
     <xacml3:Description></xacml3:Description> 
     <xacml3:PolicyDefaults> 
     <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion> 
     </xacml3:PolicyDefaults> 
     <xacml3:Target> 
     <xacml3:AnyOf> 
      <xacml3:AllOf> 
       <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
        <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">TPS_AE_REST_Policy</xacml3:AttributeValue> 
        <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator> 
       </xacml3:Match> 
      </xacml3:AllOf> 
     </xacml3:AnyOf> 
     </xacml3:Target> 
     <xacml3:Rule Effect="Permit" RuleId="http://axiomatics.com/alfa/identifier/com.red.XACML.permitAll"> 
     <xacml3:Description></xacml3:Description> 
     <xacml3:Target></xacml3:Target> 
     </xacml3:Rule> 
     <xacml3:Rule Effect="Deny" RuleId="http://axiomatics.com/alfa/identifier/com.red.XACML.checkId"> 
     <xacml3:Description></xacml3:Description> 
     <xacml3:Target></xacml3:Target> 
     <xacml3:Condition> 
      <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not"> 
       <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of"> 
        <xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"></xacml3:Function> 
        <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">[email protected]</xacml3:AttributeValue> 
        <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" MustBePresent="false"></xacml3:AttributeDesignator> 
       </xacml3:Apply> 
      </xacml3:Apply> 
     </xacml3:Condition> 
     <xacml3:ObligationExpressions> 
      <xacml3:ObligationExpression ObligationId="obligation.displayAttributes" FulfillOn="Deny"> 
       <xacml3:AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
        <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Access denied due to invalid UserID</xacml3:AttributeValue> 
       </xacml3:AttributeAssignmentExpression> 
      </xacml3:ObligationExpression> 
     </xacml3:ObligationExpressions> 
     </xacml3:Rule> 
     <xacml3:AdviceExpressions> 
     <xacml3:AdviceExpression AdviceId="advice.displayAttributes" AppliesTo="Deny"> 
      <xacml3:AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
       <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Valid subjectId</xacml3:AttributeValue> 
      </xacml3:AttributeAssignmentExpression> 
     </xacml3:AdviceExpression> 
     <xacml3:AdviceExpression AdviceId="advice.displayAttributes" AppliesTo="Permit"> 
      <xacml3:AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
       <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Valid subjectId</xacml3:AttributeValue> 
      </xacml3:AttributeAssignmentExpression> 
     </xacml3:AdviceExpression> 
     </xacml3:AdviceExpressions> 
    </xacml3:Policy>

在這裏，在XML創建的策略集命名cfapolicyset1：

<!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). Any modification to this file will be lost upon recompilation of the source ALFA file--> 
    <xacml3:PolicySet xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicySetId="cfapolicyset1" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:permit-overrides" Version="1.0"> 
     <xacml3:Description></xacml3:Description> 
     <xacml3:PolicySetDefaults> 
     <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion> 
     </xacml3:PolicySetDefaults> 
     <xacml3:Target> 
     <xacml3:AnyOf> 
      <xacml3:AllOf> 
       <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> 
        <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">TPS_AE_REST_Policy</xacml3:AttributeValue> 
        <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="false"></xacml3:AttributeDesignator> 
       </xacml3:Match> 
      </xacml3:AllOf> 
     </xacml3:AnyOf> 
     </xacml3:Target> 
     <xacml3:PolicyIdReference>cfatest0</xacml3:PolicyIdReference> 
    </xacml3:PolicySet>

下面由WSO2產生的請求「嘗試，它」工具下的PAP：

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false"> 
    <Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" IncludeInResult="false"> 
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">[email protected]</AttributeValue> 
     </Attribute> 
    </Attributes> 
    <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
     <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="false"> 
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">TPS_AE_REST_Policy</AttributeValue> 
     </Attribute> 
    </Attributes> 
</Request>

決定是：不適用

難道我錯過我如何使用發送到策略集的請求方式的東西嗎？使用WSO2高級策略編輯器時，在響應中出現相同的錯誤。在測試PAP「Try-It」工具中的政策時，我會收到正確的值，對於此政策，此值爲「許可」。

來源

2016-06-14 Claude Falbriard

我在Axiomatics Policy Administration Point中嘗試了您的請求和策略，我得到了所需的響應，即Permit + Advice。

難道你忘了裝載內部WSO2IS政策？

來源

2016-06-15 06:58:43

感謝測試的情況下@大衛布羅薩德，你的提示是正確的，在PolicyReference聲明中引用的政策必須存在的策略集的源代碼，會後聲明的權利放在裏面：xacml3：PolicyIdReference。在一個XML文件中提供源代碼，WSO2 PAP工具能夠正確解釋它，而無需將設置和引用策略加載到PDP中。這對測試很有幫助。 –

WSO2身份服務器 - PAP

回答

相關問題