2

我想知道在 XACML V.3 下是否有机会共同生活在同一规则中的<Condition>和部分。<Target>看起来 XLS 模式验证正在拒绝这样的构造。这个错误是否可以通过语句序列来解释，或者这样的结构是简单的、不可预见的，还是可能的？

4

1 回答 1

1

在仔细查看了几篇博客并查看了我的 XACML 源代码构造之后，我能够将 <Target> 和 <Condition> 语句加入到一个规则中。我的发现是 <Target> 总是应该在 <Condition> 语句之前。请参阅下面的示例策略：

<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"  PolicyId="TestCityCountry" Version="1.0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:permit-overrides">
   <xacml3:PolicyDefaults>
      <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
   </xacml3:PolicyDefaults>
   <xacml3:Target></xacml3:Target>
   <!--deny all other conditions-->
      <xacml3:Rule Effect="Deny" RuleId="Deny-Rule2"></xacml3:Rule>
      <xacml3:Rule RuleId="Permit-Rule1" Effect="Permit">
         <xacml3:Target>
            <xacml3:AnyOf>
               <xacml3:AllOf>
                  <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                     <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">631</xacml3:AttributeValue>
                     <xacml3:AttributeDesignator AttributeId="http://w3.red.com/subject/employeeCountryCode" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></xacml3:AttributeDesignator>
                  </xacml3:Match>
               </xacml3:AllOf>
            </xacml3:AnyOf>
            <xacml3:AnyOf>
               <xacml3:AllOf>
                  <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                     <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ldap</xacml3:AttributeValue>
                     <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></xacml3:AttributeDesignator>
                  </xacml3:Match>
               </xacml3:AllOf>
            </xacml3:AnyOf>
            <xacml3:AnyOf>
               <xacml3:AllOf>
                  <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                     <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</xacml3:AttributeValue>
                     <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></xacml3:AttributeDesignator>
                  </xacml3:Match>
               </xacml3:AllOf>
            </xacml3:AnyOf>
         </xacml3:Target>
         <xacml3:Condition>
            <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
               <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:environment-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></xacml3:AttributeDesignator>
               <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                  <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Brasilia</xacml3:AttributeValue>
                  <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Curitiba</xacml3:AttributeValue>
                  <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Bahia</xacml3:AttributeValue>
                  <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Porto Alegre</xacml3:AttributeValue>
                  <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Rio de Janeiro</xacml3:AttributeValue>
                  <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">São Paulo</xacml3:AttributeValue>
               </xacml3:Apply>
            </xacml3:Apply>
         </xacml3:Condition>
         <xacml3:ObligationExpressions>
            <xacml3:ObligationExpression FulfillOn="Permit" ObligationId="citycountrycheck">
               <xacml3:AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
                  <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Rule 1: The city and country validation passed successfully</xacml3:AttributeValue>
               </xacml3:AttributeAssignmentExpression>
            </xacml3:ObligationExpression>
         </xacml3:ObligationExpressions>
         <xacml3:AdviceExpressions>
            <xacml3:AdviceExpression AdviceId="city-country-validated" AppliesTo="Permit">
               <xacml3:AttributeAssignmentExpression AttributeId="city-country-validated">
                  <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">CityCountryValidated</xacml3:AttributeValue>
               </xacml3:AttributeAssignmentExpression>
            </xacml3:AdviceExpression>
         </xacml3:AdviceExpressions>
      </xacml3:Rule>
      <xacml3:ObligationExpressions>
         <xacml3:ObligationExpression FulfillOn="Permit" ObligationId="allchecks">
            <xacml3:AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
               <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">The overall validation passed successfully</xacml3:AttributeValue>
            </xacml3:AttributeAssignmentExpression>
         </xacml3:ObligationExpression>
      </xacml3:ObligationExpressions>
   </xacml3:Policy>
于 2015-11-25T16:48:55.490 回答