java - XACML Policy Evaluation Error -
i followed link run pdp using saml envelope on xacml. created webservice ( pdp , pdpclient - in other words xacml request generator ). here every thing run fine i.e. generate request , result perfect given (test policies given followed link) policies.
now test pdp policies !! ( in point of view ) pdp isn't evaluate policies correctly. example here policy
<?xml version="1.0" encoding="utf-8" standalone="yes"?> <policy xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os" policyid="serverdatadeletion" version="2.0" rulecombiningalgid="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"> <description>server data deletion student</description> <target> <subjects> <subject> <subjectmatch matchid="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <attributevalue datatype="http://www.w3.org/2001/xmlschema#string">visitor</attributevalue> <subjectattributedesignator attributeid="urn:oasis:names:tc:xacml:1.0:subject:outside-university" datatype="http://www.w3.org/2001/xmlschema#string" mustbepresent="true" /> </subjectmatch> </subject> </subjects> <resources> <resource> <resourcematch matchid="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <attributevalue datatype="http://www.w3.org/2001/xmlschema#string">server file</attributevalue> <resourceattributedesignator attributeid="urn:oasis:names:tc:xacml:1.0:resource:file123" datatype="http://www.w3.org/2001/xmlschema#string" mustbepresent="true" /> </resourcematch> </resource> </resources> <actions> <action> <actionmatch matchid="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <attributevalue datatype="http://www.w3.org/2001/xmlschema#string">delete</attributevalue> <actionattributedesignator attributeid="urn:oasis:names:tc:xacml:1.0:action:delete123" datatype="http://www.w3.org/2001/xmlschema#string" mustbepresent="true" /> </actionmatch> </action> </actions> </target> <rule ruleid="serverdatadeletion" effect="permit"> <description>server data deletion</description> <target> <subjects> <subject> <subjectmatch matchid="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <attributevalue datatype="http://www.w3.org/2001/xmlschema#string">student</attributevalue> <subjectattributedesignator attributeid="urn:oasis:names:tc:xacml:1.0:subject:inside-university123" datatype="http://www.w3.org/2001/xmlschema#string" mustbepresent="true" /> </subjectmatch> </subject> </subjects> <resources> <resource> <resourcematch matchid="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <attributevalue datatype="http://www.w3.org/2001/xmlschema#string">server file</attributevalue> <resourceattributedesignator attributeid="urn:oasis:names:tc:xacml:1.0:resource:file" datatype="http://www.w3.org/2001/xmlschema#string" mustbepresent="false" /> </resourcematch> </resource> </resources> <actions> <action> <actionmatch matchid="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <attributevalue datatype="http://www.w3.org/2001/xmlschema#string">delete</attributevalue> <actionattributedesignator attributeid="urn:oasis:names:tc:xacml:1.0:action:delete" datatype="http://www.w3.org/2001/xmlschema#string" mustbepresent="false" /> </actionmatch> </action> </actions> </target> </rule> <rule ruleid="default" effect="deny" /> </policy> and here request
subject-id: urn:oasis:names:tc:xacml:1.0:subject:outside-university, subject-value: staff
arttibute-id: urn:oasis:names:tc:xacml:1.0:resource:file123, attribute-value: server file
action-id: urn:oasis:names:tc:xacml:1.0:action:delete123, action-value: delete
and response deny. see mustbepresent = true in subject, resource , action of policy-target , request contains none's id. according xacml 2.0 if mustbepresent true , ids not present in request target indeterminate. , if target policy-target whole policy indeterminate. in case after indeterminate policy-target, pdp still evaluate rule , making result according rule combining algorithm.
let me know if wrong.
actually, @ quick glance, should getting notapplicable.
you have following structure:
- policy
- rule 1: serverdatadeletion yields permit
- rule 2: default yields deny.
your policy has target follows:
<target> <subjects> <subject> <subjectmatch matchid="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <attributevalue datatype="http://www.w3.org/2001/xmlschema#string">visitor</attributevalue> <subjectattributedesignator attributeid="urn:oasis:names:tc:xacml:1.0:subject:outside-university" datatype="http://www.w3.org/2001/xmlschema#string" mustbepresent="true" /> </subjectmatch> </subject> </subjects> <resources> <resource> <resourcematch matchid="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <attributevalue datatype="http://www.w3.org/2001/xmlschema#string">server file</attributevalue> <resourceattributedesignator attributeid="urn:oasis:names:tc:xacml:1.0:resource:file123" datatype="http://www.w3.org/2001/xmlschema#string" mustbepresent="true" /> </resourcematch> </resource> </resources> <actions> <action> <actionmatch matchid="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <attributevalue datatype="http://www.w3.org/2001/xmlschema#string">delete</attributevalue> <actionattributedesignator attributeid="urn:oasis:names:tc:xacml:1.0:action:delete123" datatype="http://www.w3.org/2001/xmlschema#string" mustbepresent="true" /> </actionmatch> </action> </actions> </target> it apply if visitor trying delete server file.
in request, send staff instead of visitor. should therefore notapplicable.
if chance, move xacml 3.0. check out alfa plugin eclipse write policies easily.
Comments
Post a Comment