XACML 3.0 Request with additional Attribute is matching even that attribute is missing in the policy rule

Question

I have a XACML 3.0 policy defined like this:

<?xml version="1.0" encoding="UTF-8"?>
<Policy 
  xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" 
  xmlns:xacml="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" 
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17 http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd" PolicyId="Proposal-Rules" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides" Version="1.0">
  <Description>Policy for any proposal.</Description>
  <PolicyDefaults>
    <XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</XPathVersion>
  </PolicyDefaults>
  <Target />
  <Rule Effect="Permit" RuleId="ApproveProposalByDepartmentChair-Rule13a">
    <Description>"Department Chair" can "Approve" a "Whole Proposal" when ApprovedByDepartmentChair = READYFORAPPROVAL and where condition check all department chairs are not approved.</Description>
    <Target>
      <AnyOf>
        <AllOf>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Department Chair</AttributeValue>
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:position.title" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
          </Match>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Whole Proposal</AttributeValue>
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:proposal.section" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
          </Match>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">READYFORAPPROVAL</AttributeValue>
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:ApprovedByDepartmentChair" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
          </Match>
          <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Approve</AttributeValue>
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:proposal.action" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
          </Match>
        </AllOf>
      </AnyOf>
    </Target>
    <Condition>
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:boolean-one-and-only">
          <AttributeSelector MustBePresent="false" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" Path="//ak:signedByAllChairs/text()" DataType="http://www.w3.org/2001/XMLSchema#boolean"/>
        </Apply>
        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">false</AttributeValue>
      </Apply>
    </Condition>
  </Rule>
</Policy>

My XACML request looks like this with an extra AttributeId="group" containing value "Computer Engineering".

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false">
                <Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
                    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:position.title" IncludeInResult="false">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Department Chair</AttributeValue>
                    </Attribute>
                    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:group" IncludeInResult="false">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Computer Engineering</AttributeValue>
                    </Attribute>
                </Attributes>
                <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
                    <Content>
                        <record xmlns:ak="http://akpower.org">
                            <proposal>  
                                <signedByAllChairs>false</signedByAllChairs>
                            </proposal>
                        </record>
                    </Content>
                    <Attribute AttributeId="urn:oasis:names:tc:xacml:3.0:content-selector" IncludeInResult="false">
                        <AttributeValue XPathCategory="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="urn:oasis:names:tc:xacml:3.0:data-type:xpathExpression">//ak:record/ak:proposal</AttributeValue>
                    </Attribute>
                    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:ApprovedByDepartmentChair" IncludeInResult="false">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">READYFORAPPROVAL</AttributeValue>
                    </Attribute>
                    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:proposal.section" IncludeInResult="false">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Whole Proposal</AttributeValue>
                    </Attribute>
                </Attributes>
                <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action">
                    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:proposal.action" IncludeInResult="false">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Approve</AttributeValue>
                    </Attribute>
                </Attributes>
    </Request>

I was hoping the PEP going to return NotApplicable but on contrary it returns following response: with PERMIT Even though the defined Policy Rule doesn't contain any Attribute called "group" as Rule Target whereas the request is sending "group" attribute with value "Computer Engineering" and even it is returning match and PERMIT response!

<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
    <Result>
        <Decision>Permit</Decision>
        <Status>
            <StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok" />
        </Status>       
    </Result>
</Response>

Is there something I am missing? I could not figure it out. I am currently using Balana as PEP implementation for my application.

Answer 1

I have now managed to import your policy inside the Axiomatics Policy Administration Point.

Basic Issues

You had several mistakes:

1. Your XPath expressions uses a prefix ak: (Path="//ak:signedByAllChairs/text()") but the XPath doesn't contain the definition for ak:
2. The AttributeSelector is marked as a boolean but text() in XPath returns a string, not a boolean. You need to change to string.
3. The XML snippet part of the XACML request <Content/> does not actually use the ak: prefix. It does define a namespace with that prefix but never uses it.

Representation of the policy in APS

Simulating the policy

I simulated your policy and did not get a Permit back. I get Indeterminate. Here is the evaluation trace. There must be something wrong in WSO2 IS or you forgot to deploy the new policy.

Now, if I clean up the XML you send to have exactly this:

<record xmlns:ak="http://akpower.org">
    <proposal>                  
        <signedByAllChairs>false</signedByAllChairs>                    
    </proposal>
</record>

then I get Permit back from the policy.