[jboss-user] [Security] - Re: RBAC Profile of XACML
"anil.saldhana(a)jboss.com" wrote : A decision of NA is as good as Deny. You
don't permit the access.
|
| The NA may be happening because an expected attribute is not passed as part of the
request.
Actually all the expected attributes were present in the request (You can verify that by
looking closely at my previous post). The policies were exactly the same as those
described in the RBAC profile document.
I managed to fix the JUnit test by adding another rule inside the PPS for the employees:
<?xml version="1.0" encoding="UTF-8"?>
| <PolicySet xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os"
| xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
| xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:policy:schema:os
|
http://docs.oasis-open.org/xacml/access_control-xacml-2.0-policy-schema-o...
| PolicySetId="PPS:employee:role"
|
PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:permit-overrides">
| <Target />
| <Policy
|
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides"
| PolicyId="Permissions:specifically:for:the:employee:role">
| <Description>
| Permissions specifically for the employee role.
| </Description>
| <Target />
| <!-- Permission to create a purchase order -->
| <Rule Effect="Permit"
RuleId="Permission:to:create:a:purchase:order">
| <Target>
| <Resources>
| <Resource>
| <ResourceMatch
| MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
| <AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">purchase order
| </AttributeValue>
| <ResourceAttributeDesignator
| AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
| DataType="http://www.w3.org/2001/XMLSchema#string" />
| </ResourceMatch>
| </Resource>
| </Resources>
| <Actions>
| <Action>
| <ActionMatch
MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
| <AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">create
| </AttributeValue>
| <ActionAttributeDesignator
| DataType="http://www.w3.org/2001/XMLSchema#string"
AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" />
| </ActionMatch>
| </Action>
| </Actions>
| </Target>
| </Rule>
| <Rule Effect="Deny" RuleId="DefaultDeny"></Rule>
| </Policy>
|
| </PolicySet>
|
That fixed the issues when run against jboss-xacml 2.0.4.
On the trunk (rev 96011) I still have two tests failing: the creation of a purchase order
by a manager or an employee is denied (when it shoud be allowed).
View the original post :
http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4264511#...
Reply to the post :
http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...