文章/答案/技术大牛

发布

社区首页 >问答首页 >在包中发送具有多个值的XACML请求，以便通过策略进行评估

问在包中发送具有多个值的XACML请求，以便通过策略进行评估
EN

Stack Overflow用户

提问于 2019-07-04 10:53:46

回答 2查看 824关注 0票数 1

下面是一个XACML策略，用于中国墙壁，它使用stringAtLeastOneMemberOf比较两个属性，看看它们是否包含一个值列表的相同值。

也就是说，如果请求访问对象的主体具有标签[1, 4, 5]，而对象具有标签[2, 3, 5]，那么访问将被拒绝，因为两者都包含5。

中国的墙政策

ALFA码

attribute subjectConflicts {
    id = "urn:oasis:names:tc:xacml:1.0:subject:subject-conflicts"
    type = string
    category = subjectCat
}
attribute resourceConflicts {
    id = "urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts"
    type = string
    category = resourceCat
}



namespace models {
    import Attributes.*

    /*
     * 
     * This policy implements the Chinese Wall model.
     * 
     */
    policy ChineseWall {
        target clause resourceType=="calcert"
        apply firstApplicable

        /*
         * Check subject is not in conflict with object OEMs and calibrators
         * 
         * This rule will deny access is user.label contains at least 1 value that is also present
         * in object.label
         */
        rule noconflict {
            target clause actionId=="read" or actionId=="write"
            condition stringAtLeastOneMemberOf(subjectConflicts, resourceConflicts)
            deny
        }
    }
}

XACML策略

<?xml version="1.0" encoding="UTF-8"?>
<!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com).-->
<!--Any modification to this file will be lost upon recompilation of the source ALFA file-->
<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="http://axiomatics.com/alfa/identifier/models.ChineseWall" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
    <xacml3:Description>This policy implements the Chinese Wall model.</xacml3:Description>
    <xacml3:PolicyDefaults>
        <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
    </xacml3:PolicyDefaults>
    <xacml3:Target>
        <xacml3:AnyOf>
            <xacml3:AllOf>
                <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">calcert</xacml3:AttributeValue>
                    <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-type" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
                </xacml3:Match>
            </xacml3:AllOf>
        </xacml3:AnyOf>
    </xacml3:Target>
    <xacml3:Rule Effect="Deny" RuleId="models.ChineseWall.noconflict">
        <xacml3:Description>Check subject is not in conflict with object OEMs and calibrators

This rule will deny access is user.label contains at least 1 value that is also present
in object.label</xacml3:Description>
        <xacml3:Target>
            <xacml3:AnyOf>
                <xacml3:AllOf>
                    <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</xacml3:AttributeValue>
                        <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
                    </xacml3:Match>
                </xacml3:AllOf>
                <xacml3:AllOf>
                    <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <xacml3:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</xacml3:AttributeValue>
                        <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
                    </xacml3:Match>
                </xacml3:AllOf>
            </xacml3:AnyOf>
        </xacml3:Target>
        <xacml3:Condition>
            <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
                <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-conflicts" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
                <xacml3:AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
            </xacml3:Apply>
        </xacml3:Condition>
    </xacml3:Rule>
</xacml3:Policy>

政策执行点(PEP)代码

我使用Authzforce核心PDP for Java来模拟PDP，并对请求进行如下评估：

private DecisionRequest parseJSONAndBuildXACML(JSONObject obj) {
    DecisionRequestBuilder builder = server.pdpEngine.getEngine().newRequestBuilder(-1, -1);

    /** Add Principle **/
    // Principle ID
    AttributeFqn principleID = AttributeFqns.newInstance(XACML_1_0_ACCESS_SUBJECT.value(), Optional.empty(), XacmlAttributeId.XACML_1_0_SUBJECT_ID.value());
    AttributeBag<?> principleIDValue = Bags.singletonAttributeBag(StandardDatatypes.STRING, new StringValue("Principle" + obj.getJSONObject("principle").getString("id")));
    builder.putNamedAttributeIfAbsent(principleID, principleIDValue);

    // Principle Label
    AttributeFqn principleLabel = AttributeFqns.newInstance(XACML_1_0_ACCESS_SUBJECT.value(), Optional.<String>empty(), XACML_1_0_SUBJECT_LABEL);
    AttributeBag<?> principleLabelValue = Bags.singletonAttributeBag(StandardDatatypes.INTEGER, new IntegerValue(new MediumInteger(obj.getJSONObject("principle").getInt("label"))));
    builder.putNamedAttributeIfAbsent(principleLabel, principleLabelValue);

    // Principle Conflict Set
    AttributeFqn principleConflicts = AttributeFqns.newInstance(XACML_1_0_ACCESS_SUBJECT.value(), Optional.empty(), XACML_1_0_SUBJECT_CONFLICTS);
    Collection<StringValue> pconflicts = getStringListFromJsonArray(obj.getJSONObject("principle").getJSONArray("conflicts"));
    AttributeBag<?> principleConflictsValue = Bags.newAttributeBag(StandardDatatypes.STRING, pconflicts);
    //AttributeBag<?> principleConflictsValue = Bags.singletonAttributeBag(StandardDatatypes.STRING, new StringValue(obj.getJSONObject("principle").getString("conflicts")));
    builder.putNamedAttributeIfAbsent(principleConflicts, principleConflictsValue);

    // Object ID
    AttributeFqn objectID = AttributeFqns.newInstance(XACML_3_0_RESOURCE.value(), Optional.empty(), XACML_1_0_RESOURCE_ID.value());
    AttributeBag<?> objectIDValue = Bags.singletonAttributeBag(StandardDatatypes.STRING, new StringValue(obj.getJSONObject("object").getString("id")));
    builder.putNamedAttributeIfAbsent(objectID, objectIDValue);

    // Object Type
    AttributeFqn objectType = AttributeFqns.newInstance(XACML_3_0_RESOURCE.value(), Optional.empty(), XACML_1_0_RESOURCE_TYPE);
    AttributeBag<?> objectTypeValue = Bags.singletonAttributeBag(StandardDatatypes.STRING, new StringValue(obj.getJSONObject("object").getString("type")));
    builder.putNamedAttributeIfAbsent(objectType, objectTypeValue);

    // Object Label
    AttributeFqn objectLabel = AttributeFqns.newInstance(XACML_3_0_RESOURCE.value(), Optional.<String>empty(), XACML_1_0_RESOURCE_LABEL);
    AttributeBag<?> objectLabelValue = Bags.singletonAttributeBag(StandardDatatypes.INTEGER, new IntegerValue(new MediumInteger(obj.getJSONObject("object").getInt("label"))));
    builder.putNamedAttributeIfAbsent(objectLabel, objectLabelValue);

    // Object Conflict Set
    AttributeFqn objectConflicts = AttributeFqns.newInstance(XACML_3_0_RESOURCE.value(), Optional.empty(), XACML_1_0_RESOURCE_CONFLICTS);
    Collection<StringValue> oconflicts = getStringListFromJsonArray(obj.getJSONObject("object").getJSONArray("conflicts"));
    AttributeBag<?> objectConflictsValue = Bags.newAttributeBag(StandardDatatypes.STRING, oconflicts);
    //AttributeBag<?> objectConflictsValue = Bags.singletonAttributeBag(StandardDatatypes.STRING, new StringValue(obj.getJSONObject("object").getString("conflicts")));
    builder.putNamedAttributeIfAbsent(objectConflicts, objectConflictsValue);

    // Action
    AttributeFqn action = AttributeFqns.newInstance(XACML_3_0_ACTION.value(), Optional.empty(), XacmlAttributeId.XACML_1_0_ACTION_ID.value());
    AttributeBag<?> actionValue = Bags.singletonAttributeBag(StandardDatatypes.STRING, new StringValue(obj.getString("action")));
    builder.putNamedAttributeIfAbsent(action, actionValue);

    return builder.build(false);
}

本例中的JSONObject就是我如何将请求从客户端发送到PDP引擎。其他策略有效，这里的问题是我向包发送了一个字符串，即"[2, 4, 5]"，但是它总是导致一个NotApplicable。这里是否有我应该使用的列表类型来符合策略？

下面是我要发送的JSON：

{
    "principle": {
        "conflicts": [
            "1",
            "2",
            "10"
        ],
        "id": "Principle 1",
        "label": 3
    },
    "action": "read",
    "object": {
        "conflicts": [
            "4",
            "5",
            "9"
        ],
        "id": "Object 1",
        "label": 2,
        "type": "calcert"
    }
}

挑战

更准确地说，用于冲突集的java代码到Authzforce的JSON输出将是一个字符串，即"[2,3,5]"，而我认为这需要另一种格式(因为它总是导致NotApplicable)，但这是我的问题。

policy

xacml

alfa

pdp

authzforce

回答 2

Stack Overflow用户

回答已采纳

发布于 2019-07-05 21:28:36

您需要修复代码中至少两个问题：

因为您希望从一个字符串列表(可能不止一个)中得到一个包，所以您必须使用更通用的Bags.newAttributeBag(...) -第二个参数必须是Strings -的实际列表，而不是 Bags.singletonAttributeBag()。只有这样，PDP才会将其视为类型为String的多个AttributeValues。
您使用相同的subject属性XACML_1_0_SUBJECT_CONFLICTS两次，第二次使用objectConflicts属性，因此我猜这是错误的，需要修复，因为这必须是资源属性urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts。

票数 2

Stack Overflow用户

发布于 2019-07-06 17:27:31

首先，您必须理解，在默认情况下，XACML中的所有属性都是值袋。因此，urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts是一个可以包含0(零)、1或更多值的包。不过，这还是个袋子。ALFA / XACML中的任何属性都是如此。这意味着当你写：

target clause resourceType=="calcert"

您实际上是说如果至少有一个resourceType值等于calcert.

在您的例子中，您使用的是一个名为stringAtLeastOneMemberOf的函数。此函数接受两袋类型的字符串，如果第一个包至少包含第二个包中的一个值，则返回true。它与stringIsIn类似，只不过后者接受一个原子字符串和一个字符串包。您必须编写stringIsIn(stringOneAndOnly(a), b)才能使其工作。属性a还必须是包含单个值的袋子。

在您的例子中，您有两个可以是多值的属性(subjectConflicts和resourceConflicts)。这意味着，如果你“打印”他们，你会看到类似于"a"，"b"，"c"，"a“的东西。这是一袋价值。顺便说一句，袋子里可以装复印机。而顺序并不重要(无论是属性的顺序还是属性值的顺序)。

现在，您要做的是发送一个XACML请求，该请求表示这一点。生成的JSON应该如下所示：

示例JSON请求

在本例中，这两个属性都是多值的：

{
   "Request":{
      "Resource":[
         {
            "Attribute":[
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:resource:resource-type",
                  "Value":"calcert"
               },
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts",
                  "Value":[
                     "4",
                     "5",
                     "6"
                  ]
               }
            ]
         }
      ],
      "Action":[
         {
            "Attribute":[
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:action:action-id",
                  "Value":"read"
               }
            ]
         }
      ],
      "AccessSubject":[
         {
            "Attribute":[
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:subject:subject-conflicts",
                  "Value":[
                     "1",
                     "2",
                     "3"
                  ]
               }
            ]
         }
      ]
   }
}

请求也可以写成

{
   "Request":{
      "Resource":[
         {
            "Attribute":[
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:resource:resource-type",
                  "Value":"calcert"
               },
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts",
                  "Value":"4"
               },
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts",
                  "Value":"5"
               },
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts",
                  "Value":"6"
               }
            ]
         }
      ],
      "Action":[
         {
            "Attribute":[
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:action:action-id",
                  "Value":"read"
               }
            ]
         }
      ],
      "AccessSubject":[
         {
            "Attribute":[
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:subject:subject-conflicts",
                  "Value":"1"
               },
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:subject:subject-conflicts",
                  "Value":"2"
               },
               {
                  "AttributeId":"urn:oasis:names:tc:xacml:1.0:subject:subject-conflicts",
                  "Value":"3"
               }
            ]
         }
      ]
   }
}

示例XACML JSON响应

{
   "Response":[
      {
         "Decision":"NotApplicable"
      }
   ]
}

为请求/响应找到正确的SDK

在您的代码中，您使用AuthZForce的PEP。西里尔在他的另一个回答中指出了主要的错误：

        AttributeBag<?> objectConflictsValue = Bags.singletonAttributeBag(StandardDatatypes.STRING, new StringValue(obj.getJSONObject("object").getString("conflicts")));

问题是，您要添加冲突"1“的整个字符串表示，.在XACML包内的单个值中，而不是单独添加每个部分。

在我的例子中，我使用了自己的Java JSON PEP SDK。代码如下所示：

要么一个一个地把每个值相加：

resource.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts", "4"));
resource.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts", "5"));
resource.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts", "6"));

或将其添加为值数组：

resource.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts", new String[]{"4","5","6"}));

全码

package io.xacml.pep.json.so;

import com.fasterxml.jackson.databind.ObjectMapper;

import io.xacml.json.model.Attribute;
import io.xacml.json.model.Category;
import io.xacml.json.model.Request;
import io.xacml.json.model.Response;
import io.xacml.json.model.Result;
import io.xacml.pep.json.client.AuthZClient;
import io.xacml.pep.json.client.ClientConfiguration;
import io.xacml.pep.json.client.DefaultClientConfiguration;
import io.xacml.pep.json.client.jaxrs.JaxRsAuthZClient;
import lombok.extern.slf4j.Slf4j;

/**
 * This class contains sample code using JAX-RS to invoke a Policy Decision Point.
 * It supports both the JSON Profile of XACML 1.0 (where the response could be either an Object or
 * an Array) and the JSON Profile of XACML 1.1 (where the response is always an array - to simplify
 * things)
 *
 * @author djob
 */
@Slf4j
public class Example {

    public static void main(String[] args) {

        ObjectMapper mapper = new ObjectMapper();
        ClientConfiguration clientConfiguration = DefaultClientConfiguration.builder()
                .pdpUrl("http://djob-hp:8080")
                .username("ads-user")
                .password("secret")
                .build();

        // Add user attributes
        Category subject = new Category();
        subject.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:subject:subject-conflicts", "1"));
        subject.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:subject:subject-conflicts", "2"));
        subject.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:subject:subject-conflicts", "3"));

        // Add action attributes - if any
        Category action = new Category();
        action.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:action:action-id", "read"));

        // Add user attributes
        Category resource = new Category();
        resource.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:resource:resource-type", "calcert"));
        resource.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts", "4"));
        resource.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts", "5"));
        resource.addAttribute(new Attribute("urn:oasis:names:tc:xacml:1.0:resource:resource-conflicts", "6"));

        Request authZRequest = new Request();
        authZRequest.addAccessSubjectCategory(subject);
        authZRequest.addActionCategory(action);
        authZRequest.addResourceCategory(resource);

        AuthZClient authZClient = new JaxRsAuthZClient(clientConfiguration, mapper);
        Response authZResponse = authZClient.makeAuthorizationRequest(authZRequest);

        for (Result r : authZResponse.getResults()) {
            log.debug(r.getDecision().name());
        }
    }
}

票数 1

页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持

原文链接：

https://stackoverflow.com/questions/56886402

复制

相似问题

问在包中发送具有多个值的XACML请求，以便通过策略进行评估
EN

回答 2

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在包中发送具有多个值的XACML请求，以便通过策略进行评估EN

回答 2

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在包中发送具有多个值的XACML请求，以便通过策略进行评估
EN