2

I am using XACML with multiple policy sets and policies. These policies are sharing the same variables and I want to be able to define them in some kind "global" dictionary. While it seems rather basic requirement, I couldn't find any documentation, example or discussion about such an option. Is there any way to do so?

Thanks.

David Brossard
  • 13,584
  • 6
  • 55
  • 88
Leonid Shepetovsky
  • 23
  • 4

1 Answers1

1

The only feature XACML provides OOTB is the notion of variable definitions and variable references. However it doesn't fully do what you're looking for.

For starters, variable definitions are defined globally but can only be used inside rules. You cannot use them inside targets. Variable definitions are made up of a XACML expression i.e. anything that can be expressed in a condition (so a string, a function, and more).

Variable definitions are defined within a policy and their visibility is scoped to that policy. This limits their usefulness.

If you wanted a cross-policy variable / constant, you'd have to do that outside XACML, define your policies, and then post-process them to replace your placeholders with your values. If you work directly on XML, you could do that with XSLT for instance. Otherwise, it'll largely depend on the IDE you're using.

Source: eXtensible Access Control Markup Language (XACML) Version 3.0 Plus Errata 01

David Brossard
  • 13,584
  • 6
  • 55
  • 88
  • 1
    Thanks, David! I use variable definitions and the exact problem with them is that they aren't cross-policy. They even can't be defined inside a policy set to be scoped at least across the inner polices of the set. The policy post-processing option will still be obusive since it will replicate all the dictionary values inside all the policies exploding the document. But I appreciate your answer and mark it as a correct solution. – Leonid Shepetovsky Dec 03 '20 at 15:41
  • Yes, I had the same concern you did. It's worth shooting an email to the OASIS XACML Technical Committee. In your comment you seem worried about policy size. I don't think that's a big deal, at least not anymore. What really matters is policy manageability and maintainability. – David Brossard Dec 03 '20 at 17:38