XACML 3.0 policy with multiple conditions

Question

I need to define a policy which allows request

to resources /tenant-3/*
for user belonging to finance role AND organization payrol

The condition I've defined is not accepted as a standard XACML.3.0 policy by wso2is editor. Could someone tell me how to define such policy ? Would be great ? Regards Vpl

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="tenant-3" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-overrides" Version="1.0">
   <Target>
      <AnyOf>
         <AllOf>
            <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">/tenant-3/*</AttributeValue>
               <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            </Match>
         </AllOf>
      </AnyOf>
   </Target>
   <Rule Effect="Permit" RuleId="rule-1">
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">finance</AttributeValue>
            <AttributeDesignator AttributeId="http://wso2.org/claims/role" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
         </Apply>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">payrol</AttributeValue>
            <AttributeDesignator AttributeId="http://wso2.org/claims/organization" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
         </Apply>

      </Condition>
   </Rule>
</Policy>

score 4 · Answer 1 · answered Jul 03 '14 at 11:23

Your policy is invalid. In your condition, you need to combine the two <Apply/> elements inside a single <Apply/> element using the urn:oasis:names:tc:xacml:1.0:function:and function.

I updated your policy and it works fine in the Axiomatics Policy Server:

<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="tenant-3" Version="1.0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-overrides">
<xacml3:PolicyDefaults><xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion></xacml3:PolicyDefaults>
  <xacml3:Target>
    <xacml3:AnyOf>
      <xacml3:AllOf>
        <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
          <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">/tenant-3/*</xacml3:AttributeValue>
          <xacml3:AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"  AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
        </xacml3:Match>
      </xacml3:AllOf>
    </xacml3:AnyOf>
  </xacml3:Target>
  <xacml3:Rule RuleId="rule-1" Effect="Permit">
    <xacml3:Condition >
      <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
        <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
          <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">finance</xacml3:AttributeValue>
          <xacml3:AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"  AttributeId="http://wso2.org/claims/role" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
        </xacml3:Apply>
        <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
          <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">payrol</xacml3:AttributeValue>
          <xacml3:AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"  AttributeId="http://wso2.org/claims/organization" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
        </xacml3:Apply>
      </xacml3:Apply>
    </xacml3:Condition>
  </xacml3:Rule>
</xacml3:Policy>

Note that you do not need a condition for a comparison as simple as the one you are doing. You can rewrite your entire policy with <Target/> as follows:

<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="tenant-3" Version="1.0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-overrides">
  <xacml3:Description></xacml3:Description>
<xacml3:PolicyDefaults><xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion></xacml3:PolicyDefaults>
  <xacml3:Target>
    <xacml3:AnyOf>
      <xacml3:AllOf>
        <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
          <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">/tenant-3/*</xacml3:AttributeValue>
          <xacml3:AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"  AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
        </xacml3:Match>
      </xacml3:AllOf>
    </xacml3:AnyOf>
  </xacml3:Target>
  <xacml3:Rule RuleId="rule-1" Effect="Permit">
    <xacml3:Description></xacml3:Description>
    <xacml3:Target>
      <xacml3:AnyOf>
        <xacml3:AllOf>
          <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">finance</xacml3:AttributeValue>
            <xacml3:AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"  AttributeId="http://wso2.org/claims/role" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
          </xacml3:Match>
          <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">payrol</xacml3:AttributeValue>
            <xacml3:AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"  AttributeId="http://wso2.org/claims/organization" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
          </xacml3:Match>
        </xacml3:AllOf>
      </xacml3:AnyOf>
    </xacml3:Target>
  </xacml3:Rule>
</xacml3:Policy>

Here's a screenshot in the Axiomatics Policy Administration Point:

The policy structure in the Axiomatics Policy Administration Point

Note by the way that you have a typo: payrol should be written payroll.

XACML 3.0 policy with multiple conditions

1 Answers1