WSO2 XACML 动态属性值

Question

我想在 Wso2 身份服务器中编写 XACML，如果用户属于该国家/地区http://localhost:8080/Country_name，我想授权用户访问国家/地区页面。

User Country
1   India
2   US
3   UK
4   Australia

并且用户国家映射是从（Web 应用程序的）UI 添加的。现在如果用户 2 登录它应该无法访问美国以外的其他国家/地区页面

谢谢 普里扬卡·戈埃尔

Answer 1

所以您是说您正在尝试访问一个页面并且该页面属于一个国家/地区。你是说：

• 如果用户与页面属于同一国家/地区，则用户可以查看该页面。

如果这确实是正确的，那么授权策略就很简单了。这是使用ALFA 的样子：

 /**
  * Control access to webpage
  */
 policy accessPage{
     target clause action_id == "view" and com.axiomatics.examples.objectType == "page"
     apply firstApplicable
     /**
      * Users can view a page if they are in the same country
      */
     rule allowSameCountry{
         permit
         condition user.country == page.country
     }
 }

在XACML (XML) 中如下所示：

<?xml version="1.0" encoding="UTF-8"?>
 <!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). 
 Any modification to this file will be lost upon recompilation of the source ALFA file-->
<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="http://axiomatics.com/alfa/identifier/so.accessPage"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
    Version="1.0">
    <xacml3:Description>Control access to webpage</xacml3:Description>
    <xacml3:PolicyDefaults>
        <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
    </xacml3:PolicyDefaults>
    <xacml3:Target>
        <xacml3:AnyOf>
            <xacml3:AllOf>
                <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <xacml3:AttributeValue
                        DataType="http://www.w3.org/2001/XMLSchema#string">view</xacml3:AttributeValue>
                    <xacml3:AttributeDesignator 
                        AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
                        DataType="http://www.w3.org/2001/XMLSchema#string"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"
                        MustBePresent="false"
                    />
                </xacml3:Match>
                <xacml3:Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <xacml3:AttributeValue
                        DataType="http://www.w3.org/2001/XMLSchema#string">page</xacml3:AttributeValue>
                    <xacml3:AttributeDesignator 
                        AttributeId="com.axiomatics.examples.objectType"
                        DataType="http://www.w3.org/2001/XMLSchema#string"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        MustBePresent="false"
                    />
                </xacml3:Match>
            </xacml3:AllOf>
        </xacml3:AnyOf>
    </xacml3:Target>
    <xacml3:Rule 
            Effect="Permit"
            RuleId="http://axiomatics.com/alfa/identifier/so.accessPage.allowSameCountry">
        <xacml3:Description>Users can view a page if they are in the same country</xacml3:Description>
        <xacml3:Target />
        <xacml3:Condition>
            <xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of-any">
                <xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
                <xacml3:AttributeDesignator 
                    AttributeId="com.axiomatics.examples.user.country"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                    MustBePresent="false"
                />
                <xacml3:AttributeDesignator 
                    AttributeId="com.axiomatics.examples.page.country"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                    MustBePresent="false"
                />
            </xacml3:Apply>
        </xacml3:Condition>
    </xacml3:Rule>
</xacml3:Policy>