问题描述
我很新的XACML。而我使用XACML给前preSS政策。但是，我找不到任何很好的例子，除了少数从的。
I am very new to XACML. And I am using XACML to express policy. But I can't find any good examples except a few from the OASIS XACML Technical Committee.
好吧，这里是我的问题：
Ok, here is my question:
我想前preSS政策使用XACML。用户可以访问的资源仅当它们满足该政策。该政策是一个合乎逻辑的前pression。例如：
I want to express policy using XACML. Users can access to the resources only if they satisfy the policy. The policy is an logical expression. For example:
（未A1）和（A2或A3）和（2（A4，A5，A6））
2（A4，A5，A6）是指它是正确的仅在2个或更多的A4，A5，A6是真实的。
2 of (A4,A5,A6) refers that it is true only if 2 or more of A4,A5,A6 is true.
AllOf和AnyOf可用于前preSSAND和OR，但我不知道怎么的前preSS2（A4，A5，A6） ，不A1。
"AllOf" and "AnyOf" can be used to express "AND" and "OR", but I don't know how to express "2 of (A4,A5,A6)" and "not A1".
感谢您！
推荐答案
根据你的要求，你需要使用一个XACML条件。住的条件规则中只有那么这意味着你得把你的逻辑规则里面。
Based on the requirement you have, you need to use a XACML condition. Conditions live within rules only so this means you'll have to put your logic inside the rule.
这是因为您将需要在XACML的目标不允许一个函数：-n个
This is because you will need a function not allowed in XACML targets: n-of.
这也是因为XACML的目标不能有负前pressions。唯一的办法，你可以前preSS不（A1）是通过一个条件。
This is also because a XACML Target cannot have negative expressions. The only way you can express Not(A1) is via a condition.
这其中的原因是，XACML带属性袋交易。所以，当你在目标写：
The reason for that is that XACML deals with attribute bags. So when you write in a target:
role==manager
您实际上说的是：如果用户等于经理至少一个角色...
What you are in fact saying is: if the user has at least one role equal to manager...
那么，什么会那相反呢？
So what would the opposite of that be?
对于你的（A，B，C），可以使用XACML功能2称为正的（骨灰盒：绿洲：名称：TC：XACML：1.0：功能：正对的的）
With respect to your 2 of (a,b,c), you can use the XACML function called n-of (urn:oasis:names:tc:xacml:1.0:function:n-of defined in A.3.5 Logical functions)
结果是在
/**
* (not A1) and (A2 OR A3) and (2 of (A4, A5,A6))
*/
policy stackoverflow{
apply firstApplicable
rule so{
condition not(A1=="some value") && (A2=="" || A3=="") && nOf(2, stringOneAndOnly(A4)=="value", stringOneAndOnly(A5)=="value", stringOneAndOnly(A6)=="value")
permit
}
}
在上面的例子中我通过A6串制成A1属性，而不是布尔向您展示如何与值进行比较。请注意，我必须使用stringOneAndOnly功能，以确保有是每一个在NOF功能使用的属性的一个值。
In the example above I made A1 through A6 string attributes instead of boolean to show how you would compare with values. Note that I have to use the stringOneAndOnly function to make sure there is a single value for each of the attributes used in the nOf function.
的XACML输出如下：
The XACML output is the following:
<?xml version="1.0" encoding="UTF-8"?>
<!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com).
Any modification to this file will be lost upon recompilation of the source ALFA file-->
<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
PolicyId="http://axiomatics.com/alfa/identifier/policing.principles.stackoverflow"
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
Version="1.0">
<xacml3:Description>(not A1) and (A2 OR A3) and (2 of (A4, A5,A6))</xacml3:Description>
<xacml3:PolicyDefaults>
<xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
</xacml3:PolicyDefaults>
<xacml3:Target />
<xacml3:Rule
Effect="Permit"
RuleId="http://axiomatics.com/alfa/identifier/policing.principles.stackoverflow.so">
<xacml3:Description />
<xacml3:Target />
<xacml3:Condition>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not" >
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
<xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">some value</xacml3:AttributeValue>
<xacml3:AttributeDesignator
AttributeId="A1"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
</xacml3:Apply>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
<xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string"></xacml3:AttributeValue>
<xacml3:AttributeDesignator
AttributeId="A2"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
<xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string"></xacml3:AttributeValue>
<xacml3:AttributeDesignator
AttributeId="A3"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
</xacml3:Apply>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:n-of" >
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#integer">2</xacml3:AttributeValue>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only" >
<xacml3:AttributeDesignator
AttributeId="A4"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">value</xacml3:AttributeValue>
</xacml3:Apply>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only" >
<xacml3:AttributeDesignator
AttributeId="A5"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">value</xacml3:AttributeValue>
</xacml3:Apply>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only" >
<xacml3:AttributeDesignator
AttributeId="A6"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
<xacml3:AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">value</xacml3:AttributeValue>
</xacml3:Apply>
</xacml3:Apply>
</xacml3:Apply>
</xacml3:Apply>
</xacml3:Condition>
</xacml3:Rule>
</xacml3:Policy>
---编辑---
--- EDIT ---
要如前preSS消极条件没有（性别==男），你有两个选择：
To express negative conditions e.g. not(gender==male), you have two options:
- 无论是可能的值是有限的例如真/假，男/女，热/暖/冷，你是幸福的构建每箱政策或规则。
- 或可能值的集合过长或无限例如数值或国籍的名单（那些180+）。
在你可以写下面前一种情况：
In the former case you can write the following:
policy checkGender{
apply firstApplicable
rule male{
target clause gender=="male"
permit
}
rule female{
target clause gender=="female"
permit
}
/**
* Optionally add a catch all case
*/
rule other{
target clause ... // Here you'd have to define other checks you are interested in
}
}
在后一种情况下，你需要写一个负面的状态。要做到这一点，你需要使用XACML条件。由于XACML条件只能住里面的规则，你需要深入到XACML规则水平。
In the latter case, you need to write a negative condition. To do that you need to use a XACML condition. Since XACML conditions only live inside rules, you need to go down to the XACML Rule level.
policy checkGender{
apply firstApplicable
rule notMale{
condition not(gender=="male")
permit
}
}
这篇关于使用XACML给前preSS政策，这是一个逻辑的前pression的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！