CODEWITHSUNDEEP
xacml3
bwgz57
bwgz57

Reputation: 51

XACML compare two request attributes.

My xacml request contains two attributes which I want to compare as part of a policy's condition.

They are:

urn:oasis:names:tc:xacml:1.0:subject:group-id
urn:oasis:names:tc:xacml:1.0:resource:resource-id

All the policy examples I've found compare only one request attribute (i.e. ResourceAttributeDesignator) with an AttributeValue which is hard coded.

How do I compare that group-id equals resource-id?

Upvotes: 2

Views: 646

Answers (2)

Nick Volk
Nick Volk

Reputation: 11

Wrapping each AttributeDesignator under function:string-equal with a function:string-one-and-only, as provided by example in the xacml 3.0 spec section 4.2.4.1 Rule 1 worked for me.

For your given use case, this solution would look like:

<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
    <AttributeDesignator
        Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" 
        AttributeId="urn:oasis:names:tc:xacml:1.0:subject:group-id" 
        DataType="http://www.w3.org/2001/XMLSchema#string"
        MustBePresent="false"/>
  </Apply>
  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
    <AttributeDesignator
        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" 
        AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" 
        DataType="http://www.w3.org/2001/XMLSchema#string"
        MustBePresent="false"/>
  </Apply>
</Apply>

Upvotes: 0

David Brossard
David Brossard

Reputation: 13834

You need to use a XACML Condition. Policy Sets, Policies, and Rules all have XACML Targets which you can use to compare an attribute to a value e.g. role=='manager'. Rules also have the XACML Condition element with which you can do more advanced comparisons including comparing two attributes.

Here is an example (using the ALFA notation):

namespace stackoverflow{

    attribute groupId{
        category = subjectCat
        id = "urn:oasis:names:tc:xacml:1.0:subject:group-id"
        type = string
    }

    attribute resourceId{
        category = resourceCat
        id = "urn:oasis:names:tc:xacml:1.0:resource:resource-id"
        type = string
    }

    policy example{

        apply firstApplicable
        rule checkGroup{
            condition groupId==resourceId
            permit
        }
    }
}

Here is the output in XACML 3.0:

<?xml version="1.0" encoding="UTF-8"?>
 <!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). 
 Any modification to this file will be lost upon recompilation of the source ALFA file-->
<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="http://axiomatics.com/alfa/identifier/stackoverflow.example"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
    Version="1.0">
    <xacml3:Description />
    <xacml3:PolicyDefaults>
        <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
    </xacml3:PolicyDefaults>
    <xacml3:Target />
    <xacml3:Rule 
            Effect="Permit"
            RuleId="http://axiomatics.com/alfa/identifier/stackoverflow.example.checkGroup">
        <xacml3:Description />
        <xacml3:Target />
        <xacml3:Condition>
            <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of-any">
                <xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
                <xacml3:AttributeDesignator 
                    AttributeId="urn:oasis:names:tc:xacml:1.0:subject:group-id"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                    MustBePresent="false"
                />
                <xacml3:AttributeDesignator 
                    AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                    MustBePresent="false"
                />
            </xacml3:Apply>
        </xacml3:Condition>
    </xacml3:Rule>
</xacml3:Policy>

You can download the ALFA plugin here.

Upvotes: 4

Related Questions