At the root of all XACML policies is a Policy or a PolicySet. A Policy represents a single access control policy, expressed through a set of rules. A PolicySet is a container that can hold other Policies or PolicySets, as well as references to policies found in remote locations. Each XACML policy document contains exactly one Policy or PolicySet root XML tag. Because a Policy or PolicySet may contain multiple policies or Rules, each of which may evaluate to different access control decisions, XACML needs some way of reconciling the decisions each makes. This is done through a collection of Combining Algorithms. Each algorithm represents a different way of combining multiple decisions into a single decision.
...
| Info |
|---|
| title | In the Simple Editor, you can see the following, |
|---|
|
Entitlement Policy Name: Name of the policy. Entitlement Policy Description: A description of the policy. This policy is based on: Define based on what entity, that you are going to write this policy. | Note |
|---|
| If you are writing policy based on web service. You can select “Resource” category and continue. Or less, if you are writing policy based on email domain of users. You can select “Subject” category and select the “Email” attribute Id and then define the email. |
You can define multiple permit rules: As an example, “Only users in admin role can do GET” This rule can be defined as follows. You need to select “Role” attribute id for “User” and fill the text box with the role name (admin) and then fill the text box of near “Action” with action name (GET) Deny rule is automatically created as the final rule. Permitted rules are evaluated from top to blow. | Note |
|---|
| - If you want to define value as java regexp expression, you need to embedded value in the curly brackets “{ }”
Ex : { ^([a-zA-Z0-9_.-])+@wso2@wso2.com } - If you want to define multiple values as OR or AND value sets. you can separate those multiple values with “|” or “&” separates
Ex :read | write | delete Ex : ReadRole & WriteRole - If you want to define value as a greater or lesser than value. you can use “<” or “>” ( We do not support ">=" or "<=")
Ex : < 34 - If you want to define two values that are in a range, you can use square brackets “[ ]” and round brackets “( )”. And two values are coma “, “ separated.
Ex: [09:00:00+05:00, 16:00:00+05:00] time between 09.00am and 04.00 pm Ex: (18, 30]greater than 18 and less than or equal to 30 |
|
...
- Rule1: Resources under “foo” collection can be read, written, edited and deleted by the users in the admin role.
- Rule 2: Resources under “foo/wso2″ collection can be read by only the users in the WSO2 (whose email address is wso2is wso2.com domaincom domain) regex for email (^([a-zA-Z0-9_.-])+@wso2@wso2.com)between 9.00am and 4.00pm (09:00:00+05:00, 16:00:00+05:00)
- All other access requests to “foo” resource must be denied.
...
Step 5: You can do a search for attributes values.
Step 6: Select only the “MediAdminstrator” role from the attribute source.
...
| Excerpt |
|---|
| Note |
|---|
| There are Policy Combining Algorithms which are used by Policy Sets and Rule Combining Algorithms which are used by Policies. Each of the algorithms mentioned below has its Policy Combining algorithm and its Rule Combining algorithms as follows: - Standard combining algorithms defined in XACML 3.0:
- urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-overrides
- urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-overrides
- urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:permit-overrides
- urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:permit-overrides
- urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable
- urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:first-applicable
- urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:only-one-applicable
- urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:ordered-deny-overrides
- urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:ordered-deny-overrides
- urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:ordered-permit-overrides
- urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:ordered-permit-overrides
- urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-unless-permit
- urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:permit-unless-deny
- urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-unless-permit
- urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:permit-unless-deny
These algorithms are explained in detail as follows, - Deny Overrides:
This combining algorithm combines decisions in such a way that if any decision is a Deny, then that decision wins.
Deny overrides is one of the safest combining algorithms since it favors a Deny decision. However, if none of the children return a Deny decision, then the combining algorithm will never produce a Deny.
- Permit Overrides:
This combining algorithm combines decisions in such a way that if any decision is a Permit, then that decision wins.
The permit overrides combining algorithm can be interesting when: At least one child must return a Permit for access to be granted overall regardless of restrictions. One wants to return all the reasons why access is being denied. This is what one could call a “greedy deny overrides”.Forinstanceifthe reason for not being able to view a resource is that(a) you are not the owner and (b) you are in the wrong department, then we could rework the previous example as follows. When any of the deny reason triggers, the response would be denied with all the applicable reasons for access being denied: - Policy Set (deny overrides): role==manager AND action==view AND resourceType==resource
- Policy 1 (permit overrides)
- Rule 1: deny if resourceOwner != userId + Advice(“you are not the owner of the resource”)
- Rule 2: deny if rsourceDepartment != userDepartment+ Advice(“you are not in the same department as the resource)
- Policy 2
- First Applicable:
This combining algorithm combines decisions in such a way that the final decision returned is the first one produced either of Permit or Deny.
First applicable is useful to shortcut policy evaluation. For instance, if a policy set contains a long series of not applicable policies and one applicable policy which returns either of Permit or Deny, then if that policy comes first and does produce Permit or Deny, the PDP will stop there and not process the other siblings.
- Deny Unless Permit | Permit Unless Deny:
In XACML there are 4 possible decisions: Permit, Deny, NotApplicable, and Indeterminate. Sometimes, it is desirable to hide the NotApplicable and Indeterminate decisions to only allow for Permit or Deny. It makes the PEP logic potentially simpler.
This combining algorithm exists only for policy sets to combine policy sets and policies. It cannot be used to combine rules. With this combining algorithm, in order for either of a Permit or Deny to be returned, then only one of the children must produce a valid decision – whether Deny or Permit. - Ordered Deny Overrides | Ordered Permit Overrides:
The ordered combining algorithms combine decisions in the same way as their (unordered) cousins. In, addition they bring the guarantee that policies, policy sets, and rules are considered in the order in which they are defined. The need to define an ordered combining algorithm stems from the fact the XACML specification does not specify whether order matters in the deny-overrides and permit-overrides combining algorithms.
|
|
...
