xacml - XACML を使用して Obligation Expression で複数の属性値を返すにはどうすればよいですか?

Question

Java アプリケーションで Balana とともに XACML 3.0 を使用しています。MY XML スキーマは次のように定義されています。

<record>
    <proposal>
            <proposalid></proposalid>
            <proposaltitle></proposaltitle>
            <pi>
                <fullname></fullname>
                <workemail></workemail>
                <userid></userid>
            </pi>
            <copis>
                <copi>
                    <fullname></fullname>
                    <workemail></workemail>
                    <userid></userid>
                </copi>
                <copi>
                    <fullname></fullname>
                    <workemail></workemail>
                    <userid></userid>
                </copi>
                <copi>
                    <firstname></firstname>
                    <lastname></lastname>
                    <workemail></workemail>
                    <userid></userid>
                </copi>
            </copis>                
        </proposal>
    </record>

私のアプリケーションは、次のように XACML リクエストを PEP に送信します。

<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:proposal.role" IncludeInResult="false">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">PI</AttributeValue>
    </Attribute>
  </Attributes>
  <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
    <Content>
      <ak:record xmlns:ak="http://akpower.org">
        <ak:proposal>
          <ak:proposalid>5702a60865dbb30b09a492cf</ak:proposalid>
          <ak:proposaltitle>Proposal 11</ak:proposaltitle>
          <ak:authorprofile>
            <ak:fullname>Milson Munakami</ak:fullname>
          </ak:authorprofile>
          <ak:pi>
            <ak:fullname>Milson Munakami</ak:fullname>
            <ak:workemail>milsonmun@yahoo.com</ak:workemail>
            <ak:userid>56fee3e965dbb35ce5c900fa</ak:userid>
          </ak:pi>
          <ak:copis>
            <ak:copi>
              <ak:fullname>PS Wang</ak:fullname>
              <ak:workemail>fdsafda@yahoo.comss</ak:workemail>
              <ak:userid>56fee3e965dbb35ce5c900fx</ak:userid>
            </ak:copi>
            <ak:copi>
              <ak:fullname>Thomas Voltz</ak:fullname>
              <ak:workemail>fdsafda@yahoo.comsss</ak:workemail>
              <ak:userid>56fee3e965dbb35ce5c900fx</ak:userid>
            </ak:copi>
          </ak:copis>
        </ak:proposal>
      </ak:record>
    </Content>
    <Attribute AttributeId="urn:oasis:names:tc:xacml:3.0:content-selector" IncludeInResult="false">
      <AttributeValue XPathCategory="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="urn:oasis:names:tc:xacml:3.0:data-type:xpathExpression">//ak:record/ak:proposal</AttributeValue>
    </Attribute>
    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:DeletedByPI" IncludeInResult="false">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">NOTDELETED</AttributeValue>
    </Attribute>
    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:proposal.section" IncludeInResult="false">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Whole Proposal</AttributeValue>
    </Attribute>
    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:SubmittedByPI" IncludeInResult="false">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">NOTSUBMITTED</AttributeValue>
    </Attribute>
  </Attributes>
  <Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action">
    <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:proposal.action" IncludeInResult="false">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Save</AttributeValue>
    </Attribute>
  </Attributes>
</Request>

私のポリシールールには次のものがあります。

<ObligationExpressions>
      <ObligationExpression ObligationId="sendEmail" FulfillOn="Permit">
        <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Your proposal has been updated. As soon as possible please review your proposal for any unwanted changes</AttributeValue>
        </AttributeAssignmentExpression>
        <AttributeAssignmentExpression AttributeId="piEmail">
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
            <AttributeSelector MustBePresent="false"
              ContextSelectorId="urn:oasis:names:tc:xacml:3.0:content-selector"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              Path="//ak:pi/ak:workemail/text()" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </Apply>
        </AttributeAssignmentExpression>        
        <AttributeAssignmentExpression AttributeId="piFullName">
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
            <AttributeSelector MustBePresent="false"
              ContextSelectorId="urn:oasis:names:tc:xacml:3.0:content-selector"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              Path="//ak:pi/ak:fullname/text()" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </Apply>
        </AttributeAssignmentExpression>
        <AttributeAssignmentExpression AttributeId="coPisEmail">
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
            <AttributeSelector MustBePresent="false"
              ContextSelectorId="urn:oasis:names:tc:xacml:3.0:content-selector"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              Path="//ak:copis/ak:copi/ak:workemail/text()" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </Apply>
        </AttributeAssignmentExpression>        
        <AttributeAssignmentExpression AttributeId="coPisFullName">
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
            <AttributeSelector MustBePresent="false"
              ContextSelectorId="urn:oasis:names:tc:xacml:3.0:content-selector"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              Path="//ak:copis/ak:copi/ak:fullname/text()" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </Apply>
        </AttributeAssignmentExpression>
      </ObligationExpression>
    </ObligationExpressions>

私の応答は次のとおりです。

<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
  <Result>
    <Decision>Permit</Decision>
    <Status>
      <StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"/>
    </Status>
    <Obligations>
      <Obligation ObligationId="sendEmail">
        <AttributeAssignment  AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text" DataType="http://www.w3.org/2001/XMLSchema#string">
          Your proposal has been updated. As soon as possible please review your proposal for any unwanted changes
        </AttributeAssignment>
        <AttributeAssignment  AttributeId="piEmail" DataType="http://www.w3.org/2001/XMLSchema#string">
          milsonmun@yahoo.com
        </AttributeAssignment>
        <AttributeAssignment  AttributeId="piFullName" DataType="http://www.w3.org/2001/XMLSchema#string">
          Milson Munakami
        </AttributeAssignment>
      </Obligation>
    </Obligations>
  </Result>
</Response>

これには、coPisEmail と coPisFullName の義務値は含まれません。また、これらの動的属性の値を取得する方法がわかりませんか? また、アプリケーションでこれらの値をどのように使用できますか? たとえば、すべての電子メールと氏名を含む 1 つの値のみを返すか、個別の値を個別の応答で返すか? ここで機能に何かが欠けていると思います：

<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:**function:string-one-and-only**">
            <AttributeSelector MustBePresent="false"
              ContextSelectorId="urn:oasis:names:tc:xacml:3.0**:content-selector**"
              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
              Path="//ak:pi/ak:workemail/text()" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </Apply>

xacml - XACML を使用して Obligation Expression で複数の属性値を返すにはどうすればよいですか?

1 に答える 1

Related

Reference