3

I have a subject like "accessTo" = ["123", "123-edit"] and a resource like "interestedId" = "123"

Now I'm trying to write a condition - where it checks "interestedId" concatenated with "-edit" equals "123-edit" in "AccessTo".

Im trying to write rule like this 

anyOfAny_xacml1(function[stringEqual], "accessTo", "interestedId"+"-edit")

It is not allowing to do this.

Any help is appreciated.

David Brossard
  • 13,584
  • 6
  • 55
  • 88
user2608601
  • 147
  • 1
  • 10

2 Answers2

2

In addition to the answer from Keerthi S ...

If you know there should only be one value of interestedId then you can do this to prevent the indeterminate from happening:

stringBagSize(interestedId) == 1 && anyOfAny(function[stringEqual], accessTo, stringOneAndOnly(interestedId) + "-edit")

If more than value is present then evaluation stops prior to reaching the function that expects only one value. This condition would return false if more than one value is present.

On the other hand if interestedId can have multiple values then this would work:

anyOfAny(function[stringEqual], accessTo, map(function[stringConcatenate],interestedId, "-edit"))

The map function will apply the stringConcatenate function to all values in the bag.

Mark Berg
  • 91
  • 4
1

Since Axiomatics products are compliant with XACML specification, all attributes by default are assumed to contain multiple values(called as 'bags').

So if you would like to append a string to an attribute use stringOneAndOnly XACML function for the attribute to indicate that the attribute can have only one value.

So assuming you mean accessTo has attribute ID as Attributes.access_subject.subject_id, interestedId has the attribute ID as Attributes.resource.resource_id and anyOfAny_xacml1 is equivalent to anyOfAny XACML function, the resulting condition would look like, 

anyOfAny(function[stringEqual], Attributes.access_subject.subject_id, stringOneAndOnly(Attributes.resource.resource_id) + "-edit")
neonidian
  • 1,221
  • 13
  • 20
  • 1
    Thanks so much for your response, it really saved my day. Just to be clear, when I use this stringOneAndOnly, I need to make sure Attributes.resource.resource_id is just a string and an array or it doesn't matter and I just need to make sure array with one value? – user2608601 Nov 28 '18 at 18:01
  • 2
    The stringOneAndOnly function checks if the attribute(here Attributes.resource.resource_id) is single-valued string. So you need to ensure that the attribute has only one value and if it has multiple values(bag), the evaluation would result a indeterminate decision. Assuming that you are using a JSON request, it can have only one value in the array of type string – neonidian Nov 28 '18 at 20:56