WSO2 Identity - XACML Simple Editor - Try It with Time Range - 错误

Question

按照简单编辑器的说明，我在 WSO2 版本 5 下使用环境时间范围参数时遇到困难。测试显示错误：

<StatusMessage>Invalid request  : DOM of request element can not be created from String</StatusMessage>

添加定义的语法为：[06:00:00+05:00, 19:00:00+05:00]

下面是简单编辑器生成的结果 XACML 代码：

政策

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="TodaysPolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Description>Doctor</Description>
   <Target>
      <AnyOf>
         <AllOf>
            <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">^(http:)</AttributeValue>
               <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            </Match>
         </AllOf>
      </AnyOf>
   </Target>
   <Rule Effect="Permit" RuleId="Rule-1">
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">delete</AttributeValue>
                  </Apply>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
               </Apply>
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-greater-than-or-equal">
                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#time" MustBePresent="true"/>
                     </Apply>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">06:00:00 05:00</AttributeValue>
                  </Apply>
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-less-than-or-equal">
                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#time" MustBePresent="true"/>
                     </Apply>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">19:00:00 05:00</AttributeValue>
                  </Apply>
               </Apply>
            </Apply>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">doctor</AttributeValue>
               </Apply>
               <AttributeDesignator AttributeId="http://wso2.org/claims/role" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="Deny-Rule"/>
</Policy>

请求（为 claims/role 和当前时间调整了 ID 字段）：

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false">
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action">
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="false">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue>
</Attribute>
</Attributes>
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
<Attribute AttributeId="http://wso2.org/claims/role" IncludeInResult="false">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">doctor</AttributeValue>
</Attribute>
</Attributes>
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" IncludeInResult="false">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">08:00:00+05:00</AttributeValue>
</Attribute>
</Attributes>
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="false">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:9444/medicalrecords</AttributeValue>
</Attribute>
</Attributes>
</Request>

在此先感谢您的支持。问候，克劳德

Answer 1

下面的语法支持基于时间 window 的授权：

由简单的编辑器以 XACML 格式构建的策略

资源输入为：{^(http:)}

输入的角色是：医生 |管理员

动作输入是：阅读 |写|删除

时间字段输入为：[06:00:00+05:00,20:00:00+05:00]

结果：允许

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="TodaysPolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Description>Rules with time</Description>
   <Target>
      <AnyOf>
         <AllOf>
            <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">^(http:)</AttributeValue>
               <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            </Match>
         </AllOf>
      </AnyOf>
   </Target>
   <Rule Effect="Permit" RuleId="Rule-1">
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">delete</AttributeValue>
                  </Apply>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
               </Apply>
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-greater-than-or-equal">
                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#time" MustBePresent="true"/>
                     </Apply>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">06:00:00 05:00</AttributeValue>
                  </Apply>
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-less-than-or-equal">
                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#time" MustBePresent="true"/>
                     </Apply>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">20:00:00 05:00</AttributeValue>
                  </Apply>
               </Apply>
            </Apply>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">doctor</AttributeValue>
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
               </Apply>
               <AttributeDesignator AttributeId="http://wso2.org/claims/role" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="Deny-Rule"/>
</Policy>

请求 – 包括当前时间

    <Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false"> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
<Attribute AttributeId="http://wso2.org/claims/role" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:9444/medicalrecords</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment">
<Attribute IncludeInResult="false" AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" >
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">08:00:00+05:00</AttributeValue> 
</Attribute> 
</Attributes> 
</Request>

希望此示例有助于阐明请求的结构。

Answer 2

虽然将当前时间直接编码到请求中确实可以做到这一点，但没有必要这样做。如果请求中不存在当前时间，XACML 3.0 标准要求 PDP 提供当前时间。

WSO2 Identity - XACML Simple Editor - Try It with Time Range - 错误

WSO2 Identity - XACML Simple Editor - Try It with Time Range - Error

identity

editor

wso2

xacml