使用ALFA和XACML編寫示例ABAC授權策略

Question

我是XACML的新手，並且正在使用ALFA編寫策略。我希望寫的政策是在銀行設定轉賬限額爲2000美元。如果要轉移的金額超過這個數額，那麼該操作應該被拒絕。

我該怎麼辦？

謝謝！

Answer 1

你的用例很簡單。我建議你先寫英語ALFA：

• 用戶可以對type==bank account資源做action==transfer當且僅當在amount transferred < the amount limit（如2000年的情況）==>許可證
• 所有其他情況下==>否認

在ALFA，上述政策成爲

namespace policies{ 
    attribute actionId{ 
     category = actionCat 
     id = "actionId" 
     type = string 
    } 

    attribute resourceType{ 
     category = resourceCat 
     id = "resourceType" 
     type = string 
    } 

    attribute amount{ 
     category = resourceCat 
     id = "amount" 
     type = double 
    } 
    /** 
    * The limit could be a subject attribute in the case it's user-specific 
    */ 
    attribute limit{ 
     category = subjectCat 
     id = "limit" 
     type = double 
    } 

    /* 
    * A user can do the `action==transfer` on a resource of `type==bank account` if and only if the `amount transferred 
    * < the amount limit` (e.g. 2000 in your case) ==> **permit** 
    * 
    */ 
    policy transfer{ 
     target clause actionId == "transfer" and resourceType=="bank account" 
     apply firstApplicable 
     rule allow{ 
      condition amount <= limit 
      permit 
     } 
     rule denyTransfer{ 
      deny 
     } 
    } 
}