如何在XACML中将两个规则组合成一个规则？

更新时间：2022-06-22 04:23:38

可以实现您的方案。最简单的方法可能是为您的策略创建一个结构。例如，您可能会说您有一个 http://www.example.com/info1的策略>和 http://www.example.com/info2 的另一个。每个策略都可以具有读取，写入，删除...的规则。或者，如果您不想指定任何操作，则可以跳过它。在您的情况下，您希望将读取内容限制为管理员和管理员。

There are several ways you can achieve your scenario. The easiest might yet be to create a structure for your policies. For instance, you might say that you have a policy for http://www.example.com/info1 and another for http://www.example.com/info2. Each policy could have rules for read, write, delete... Or if you do not want to specify any action then you could skip it. In your case, you want to restrict read to administrators and managers.

使用 ALFA 语法，这将为您提供：

Using the ALFA syntax, this gives you:

namespace so{
    attribute group{
        category = subjectCat
        id = "group"
        type = string
    }
    // Standard XACML attributes e.g. resource-id
    import Attributes.*

    policyset resources{
        apply firstApplicable
        policy info1{            
            target clause resourceId == "http://www.example.com/info1"
            apply firstApplicable
            rule read{
                target clause Attributes.actionId=="read"
                       clause group=="admin" or group=="manager"
                permit 
            }
            // Add other rules for other actions here
        }
        policy info2{
            target clause resourceId == "http://www.example.com/info2"
            apply firstApplicable
            rule read{
                target clause Attributes.actionId=="read"
                       clause group=="admin" or group=="manager"
                permit 
            }
            // Add other rules for other actions here
        }
    }
}

那不能完全回答您的问题。首先，它不会被合并为一个规则（这样做并不是很好，顺便说一句，我不会这么做-定义一个好的结构，它更易于管理）。在我的方法中，您必须明确列出所有其他操作。

That said this does not answer your question exactly. Firstly it is not combined in a single rule (doing that is not great BTW, I wouldn't do it - define a good structure, it is more manageable). And in my approach, you have to explicitly list all other actions.

这里是另一种方法

policy allowAccess{
    target clause resourceId == "http://www.example.com/info1" or resourceId == "http://www.example.com/info2"
    apply firstApplicable
    rule allowRead{
        target clause group=="admin" and group=="manager" and Attributes.actionId=="read"
        permit
    }
    rule allowOtherActions{
        condition not(Attributes.actionId=="read")
        permit
    }
}

最终的精简版本为

policy allowAccess2{
    apply firstApplicable
    rule allow{
        target clause resourceId == "http://www.example.com/info1" or resourceId == "http://www.example.com/info2"
        condition (group=="admin" && group=="manager" && Attributes.actionId=="read") || (not(Attributes.actionId=="read"))
        permit
    }
}

XACML输出为：

<?xml version="1.0" encoding="UTF-8"?>
 <!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). 
 Any modification to this file will be lost upon recompilation of the source ALFA file-->
<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="http://axiomatics.com/alfa/identifier/so.allowAccess2"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
    Version="1.0">
    <xacml3:Description />
    <xacml3:PolicyDefaults>
        <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
    </xacml3:PolicyDefaults>
    <xacml3:Target />
    <xacml3:Rule 
            Effect="Permit"
            RuleId="http://axiomatics.com/alfa/identifier/so.allowAccess2.allow">
        <xacml3:Description />
        <xacml3:Target>
            <xacml3:AnyOf>
                <xacml3:AllOf>
                    <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <xacml3:AttributeValue
                            DataType="http://www.w3.org/2001/XMLSchema#string">http://www.example.com/info1</xacml3:AttributeValue>
                        <xacml3:AttributeDesignator 
                            AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
                            DataType="http://www.w3.org/2001/XMLSchema#string"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            MustBePresent="false"
                        />
                    </xacml3:Match>
                </xacml3:AllOf>
                <xacml3:AllOf>
                    <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <xacml3:AttributeValue
                            DataType="http://www.w3.org/2001/XMLSchema#string">http://www.example.com/info2</xacml3:AttributeValue>
                        <xacml3:AttributeDesignator 
                            AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
                            DataType="http://www.w3.org/2001/XMLSchema#string"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            MustBePresent="false"
                        />
                    </xacml3:Match>
                </xacml3:AllOf>
            </xacml3:AnyOf>
        </xacml3:Target>
        <xacml3:Condition>
            <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
                <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                    <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
                        <xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
                        <xacml3:AttributeValue
                            DataType="http://www.w3.org/2001/XMLSchema#string">admin</xacml3:AttributeValue>
                        <xacml3:AttributeDesignator 
                            AttributeId="group"
                            DataType="http://www.w3.org/2001/XMLSchema#string"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            MustBePresent="false"
                        />
                    </xacml3:Apply>
                    <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                        <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
                            <xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
                            <xacml3:AttributeValue
                                DataType="http://www.w3.org/2001/XMLSchema#string">manager</xacml3:AttributeValue>
                            <xacml3:AttributeDesignator 
                                AttributeId="group"
                                DataType="http://www.w3.org/2001/XMLSchema#string"
                                Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                                MustBePresent="false"
                            />
                        </xacml3:Apply>
                        <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
                            <xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
                            <xacml3:AttributeValue
                                DataType="http://www.w3.org/2001/XMLSchema#string">read</xacml3:AttributeValue>
                            <xacml3:AttributeDesignator 
                                AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
                                DataType="http://www.w3.org/2001/XMLSchema#string"
                                Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"
                                MustBePresent="false"
                            />
                        </xacml3:Apply>
                    </xacml3:Apply>
                </xacml3:Apply>
                <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not" >
                    <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
                        <xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
                        <xacml3:AttributeValue
                            DataType="http://www.w3.org/2001/XMLSchema#string">read</xacml3:AttributeValue>
                        <xacml3:AttributeDesignator 
                            AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
                            DataType="http://www.w3.org/2001/XMLSchema#string"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"
                            MustBePresent="false"
                        />
                    </xacml3:Apply>
                </xacml3:Apply>
            </xacml3:Apply>
        </xacml3:Condition>
    </xacml3:Rule>
</xacml3:Policy>

上一篇 : ：foreach循环-仅返回一条记录下一篇 : 如何在 SQL 中返回第二个最新记录?

如何在XACML中将两个规则组合成一个规则？

相关阅读

技术问答最新文章