在 XACML JSON 请求/响应中关联资源答案

【问题标题】：Correlating resources in a XACML JSON request / response在 XACML JSON 请求/响应中关联资源
【发布时间】：2018-04-17 11:42:55
【问题描述】：

我正在尝试使用 REST API 评估 XACML 请求。我使用 JSON 请求来获取“根”下所有资源的决策。 WSO2给了我结果，但是我没有得到结果中对应的资源

https://docs.wso2.com/display/IS530/Using+REST+APIs+via+XACML+to+Manage+Entitlement

JSON 格式的 XACML 请求

{
    "Request": {
        "Action": {
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "POST"
                }
            ]
        },
        "Resource": {
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                    "Value": "root"
                }, {
                    "AttributeId": "urn:oasis:names:tc:xacml:2.0:resource:scope",
                    "Value": "Children"
                }
            ]
        },
        "AccessSubject": {
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:subject:subject-id",
                    "Value": "customer"
                }
            ]
        }
    }
}

JSON 格式的 XACML 响应

{
    "Response": [{
            "Decision": "Deny",
            "Status": {
                "StatusCode": {
                    "Value": "urn:oasis:names:tc:xacml:1.0:status:ok"
                }
            }
        }, {
            "Decision": "Permit",
            "Status": {
                "StatusCode": {
                    "Value": "urn:oasis:names:tc:xacml:1.0: status: ok "
                }
            }
        }
    ]
}

我没有获得任何结果的资源。我将如何关联结果？

【问题讨论】：

标签： authorization access-control xacml abac alfa

【解决方案1】：

您的请求中有几处错误。

首先，您正在尝试使用 XACML 的多决策配置文件（即一次提出多个问题并一次获得多个响应的方法）。您正在使用一个名为urn:oasis:names:tc:xacml:2.0:resource:scope xacml 的特殊属性。该属性实际上属于旧版本的XACML 的多决策配置文件，称为Multiple resource profile of XACML v2.0。这是你的第一个错误。 XACML 的 JSON 配置文件仅适用于 XACML 3.0。因此，您不能使用仅适用于 XACML 2.0 的旧配置文件。你在哪里找到这个例子的？

其次，让我们假设请求确实通过了。您的请求，正如它所写的那样，永远不应触发多重决策响应。它应该失败或返回单个响应。那是因为您没有在资源属性中指明子项。所以你不可能得到回应。

接下来，我建议您阅读JSON Profile of XACML，它解释了如何产生多个决策请求和响应。这是一个例子：

Alice 可以编辑、查看和删除 doc #123 吗？

{
    "Request": {
        "AccessSubject": {
            "Attribute": [{
                    "AttributeId": "com.axiomatics.username",
                    "Value": "Alice"
                }
            ]
        },
        "Action": [{
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "view"
                }
            ]
        },{
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "edit"
                }
            ]
        },{
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "delete"
                }
            ]
        }],
        "Resource": {
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                    "Value": "123"
                }, {
                    "AttributeId": "resource-type",
                    "Value": "document"
                }
            ]
        }
    }
}

然后回应：

{"Response": [
      {
      "Decision": "Deny",
      "Status": {"StatusCode":       {
         "Value": "urn:oasis:names:tc:xacml:1.0:status:ok",
         "StatusCode": {"Value": "urn:oasis:names:tc:xacml:1.0:status:ok"}
      }}
   },
      {
      "Decision": "Deny",
      "Status": {"StatusCode":       {
         "Value": "urn:oasis:names:tc:xacml:1.0:status:ok",
         "StatusCode": {"Value": "urn:oasis:names:tc:xacml:1.0:status:ok"}
      }}
   },
      {
      "Decision": "Deny",
      "Status": {"StatusCode":       {
         "Value": "urn:oasis:names:tc:xacml:1.0:status:ok",
         "StatusCode": {"Value": "urn:oasis:names:tc:xacml:1.0:status:ok"}
      }}
   }
]}

关联响应

现在，如果您想将请求与响应关联起来，每个属性都有一个名为IncludeInResult 的标志，默认为false，可以切换为true。

这是一个例子

请求

{
    "Request": {
        "AccessSubject": {
            "Attribute": [{
                    "AttributeId": "com.axiomatics.username",
                    "Value": "Alice"
                }
            ]
        },
        "Action": [{
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "view",
                    "IncludeInResult": true
                }
            ]
        },{
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "edit",
                    "IncludeInResult": true
                }
            ]
        },{
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "delete",
                    "IncludeInResult": true
                }
            ]
        }],
        "Resource": {
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                    "Value": "123"
                }, {
                    "AttributeId": "resource-type",
                    "Value": "document"
                }
            ]
        }
    }
}

响应

{"Response": [
      {
      "Decision": "Deny",
      "Status": {"StatusCode":       {
         "Value": "urn:oasis:names:tc:xacml:1.0:status:ok",
         "StatusCode": {"Value": "urn:oasis:names:tc:xacml:1.0:status:ok"}
      }},
      "Category":       {
         "CategoryId": "urn:oasis:names:tc:xacml:3.0:attribute-category:action",
         "Attribute":          {
            "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
            "Value": "delete",
            "DataType": "http://www.w3.org/2001/XMLSchema#string"
         }
      }
   },
      {
      "Decision": "Deny",
      "Status": {"StatusCode":       {
         "Value": "urn:oasis:names:tc:xacml:1.0:status:ok",
         "StatusCode": {"Value": "urn:oasis:names:tc:xacml:1.0:status:ok"}
      }},
      "Category":       {
         "CategoryId": "urn:oasis:names:tc:xacml:3.0:attribute-category:action",
         "Attribute":          {
            "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
            "Value": "edit",
            "DataType": "http://www.w3.org/2001/XMLSchema#string"
         }
      }
   },
      {
      "Decision": "Deny",
      "Status": {"StatusCode":       {
         "Value": "urn:oasis:names:tc:xacml:1.0:status:ok",
         "StatusCode": {"Value": "urn:oasis:names:tc:xacml:1.0:status:ok"}
      }},
      "Category":       {
         "CategoryId": "urn:oasis:names:tc:xacml:3.0:attribute-category:action",
         "Attribute":          {
            "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
            "Value": "view",
            "DataType": "http://www.w3.org/2001/XMLSchema#string"
         }
      }
   }
]}

【讨论】：

即使我使用 IncludeInResult，我也没有得到相应的值作为响应。请求是 --> { "Request": { "Action": { "Attribute": [ { "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id", "Value": "POST", "IncludeInResult": true} ] }, "Resource": { "Attribute": [ { "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id", "Value ": "root", "IncludeInResult": true } ] }, "AccessSubject": { "Attribute": [ { "AttributeId": "urn:oasis:names:tc:xacml:1.0:subject:subject-id", “价值”：“客户”，“IncludeInResult”：真 } ] } } }
并且响应是 {"Response":[{"Decision":"Deny","Status":{"StatusCode":{"Value":"urn:oasis:names:tc: xacml:1.0:status:ok"}}}]}
这告诉你 WSO2IS 不符合 XACML 3.0 规范 :-)
不，JSON 不适合我！相反，我改用 XML。

【解决方案2】：

WSO2-IS 完全支持带有 XML 的 XACML 3.0 规范。通过 IS 5.6.0 Milestone 2，WSO2 支持 JSON 的多决策配置文件

【讨论】：

在这种情况下，“我们”是谁？
这里有一些博客：[1] docs.wso2.com/display/IS560/… [2] docs.wso2.com/display/IS560/… [3] medium.com/@gdrdabarera/…

【解决方案3】：

如果您尝试 XACML JSON 请求，应该如下所示：

 {
   "Request": {
      "http://wso2.org/identity/user": [
      {
         "Attribute": [
            {
               "AttributeId": "http://wso2.org/identity/user/username",
               "Value": "adminUser",
                "IncludeInResult": true,
                "DataType": "string"
            }
         ]
      },{
         "Attribute": [
            {
               "AttributeId": "http://wso2.org/identity/user/username",
               "Value": "publicUser",
                "IncludeInResult": true,
                "DataType": "string"
            }
         ]
      }  ],

      "Resource": {
         "Attribute": [
            {
               "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
               "Value": "index.jsp",
                "IncludeInResult": true,
                "DataType": "http://www.w3.org/2001/XMLSchema#string"
            }
         ]
      },
      "Action": [{
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "view-welcome",
                     "IncludeInResult": true,
                     "DataType": "http://www.w3.org/2001/XMLSchema#string"
                }
            ]
        },{
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "view-status",
                     "IncludeInResult": true,
                     "DataType": "http://www.w3.org/2001/XMLSchema#string"
                }
            ]
        },{
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "view-summary",
                     "IncludeInResult": true,
                     "DataType": "http://www.w3.org/2001/XMLSchema#string"
                }
            ]
        },{
            "Attribute": [{
                    "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                    "Value": "modify-welcome",
                     "IncludeInResult": true,
                     "DataType": "http://www.w3.org/2001/XMLSchema#string"
                }
            ]
        } ] 
   }
}

相关响应如下，

{
    "Response": [
        {
            "Decision": "Deny",
            "Status": {
                "StatusCode": {
                    "Value": "urn:oasis:names:tc:xacml:1.0:status:ok"
                }
            },
            "Obligations": [
                {
                    "Id": "fail_to_permit",
                    "AttributeAssignments": [
                        {
                            "AttributeId": "obligation-id",
                            "Value": "You can not access the resource index.jsp",
                            "DataType": "http://www.w3.org/2001/XMLSchema#string"
                        }
                    ]
                }
            ],
            "Resource": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                        "Value": "index.jsp",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "http://wso2.org/identity/user": {
                "Attribute": [
                    {
                        "AttributeId": "http://wso2.org/identity/user/username",
                        "Value": "adminUser",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "Action": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                        "Value": "view-status",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            }
        },
        {
            "Decision": "Deny",
            "Status": {
                "StatusCode": {
                    "Value": "urn:oasis:names:tc:xacml:1.0:status:ok"
                }
            },
            "Obligations": [
                {
                    "Id": "fail_to_permit",
                    "AttributeAssignments": [
                        {
                            "AttributeId": "obligation-id",
                            "Value": "You can not access the resource index.jsp",
                            "DataType": "http://www.w3.org/2001/XMLSchema#string"
                        }
                    ]
                }
            ],
            "Resource": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                        "Value": "index.jsp",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "http://wso2.org/identity/user": {
                "Attribute": [
                    {
                        "AttributeId": "http://wso2.org/identity/user/username",
                        "Value": "adminUser",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "Action": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                        "Value": "view-summary",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            }
        },
        {
            "Decision": "Permit",
            "Status": {
                "StatusCode": {
                    "Value": "urn:oasis:names:tc:xacml:1.0:status:ok"
                }
            },
            "Resource": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                        "Value": "index.jsp",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "Action": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                        "Value": "view-welcome",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "http://wso2.org/identity/user": {
                "Attribute": [
                    {
                        "AttributeId": "http://wso2.org/identity/user/username",
                        "Value": "publicUser",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            }
        },
        {
            "Decision": "Permit",
            "Status": {
                "StatusCode": {
                    "Value": "urn:oasis:names:tc:xacml:1.0:status:ok"
                }
            },
            "Action": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                        "Value": "view-summary",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "Resource": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                        "Value": "index.jsp",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "http://wso2.org/identity/user": {
                "Attribute": [
                    {
                        "AttributeId": "http://wso2.org/identity/user/username",
                        "Value": "publicUser",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            }
        },
        {
            "Decision": "Deny",
            "Status": {
                "StatusCode": {
                    "Value": "urn:oasis:names:tc:xacml:1.0:status:ok"
                }
            },
            "Obligations": [
                {
                    "Id": "fail_to_permit",
                    "AttributeAssignments": [
                        {
                            "AttributeId": "obligation-id",
                            "Value": "You can not access the resource index.jsp",
                            "DataType": "http://www.w3.org/2001/XMLSchema#string"
                        }
                    ]
                }
            ],
            "Resource": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                        "Value": "index.jsp",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "http://wso2.org/identity/user": {
                "Attribute": [
                    {
                        "AttributeId": "http://wso2.org/identity/user/username",
                        "Value": "adminUser",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "Action": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                        "Value": "view-welcome",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            }
        },
        {
            "Decision": "Deny",
            "Status": {
                "StatusCode": {
                    "Value": "urn:oasis:names:tc:xacml:1.0:status:ok"
                }
            },
            "Obligations": [
                {
                    "Id": "fail_to_permit",
                    "AttributeAssignments": [
                        {
                            "AttributeId": "obligation-id",
                            "Value": "You can not access the resource index.jsp",
                            "DataType": "http://www.w3.org/2001/XMLSchema#string"
                        }
                    ]
                }
            ],
            "Action": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                        "Value": "view-status",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "http://wso2.org/identity/user": {
                "Attribute": [
                    {
                        "AttributeId": "http://wso2.org/identity/user/username",
                        "Value": "publicUser",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "Resource": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                        "Value": "index.jsp",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            }
        },
        {
            "Decision": "Deny",
            "Status": {
                "StatusCode": {
                    "Value": "urn:oasis:names:tc:xacml:1.0:status:ok"
                }
            },
            "Obligations": [
                {
                    "Id": "fail_to_permit",
                    "AttributeAssignments": [
                        {
                            "AttributeId": "obligation-id",
                            "Value": "You can not access the resource index.jsp",
                            "DataType": "http://www.w3.org/2001/XMLSchema#string"
                        }
                    ]
                }
            ],
            "Action": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                        "Value": "modify-welcome",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "http://wso2.org/identity/user": {
                "Attribute": [
                    {
                        "AttributeId": "http://wso2.org/identity/user/username",
                        "Value": "publicUser",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "Resource": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                        "Value": "index.jsp",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            }
        },
        {
            "Decision": "Permit",
            "Status": {
                "StatusCode": {
                    "Value": "urn:oasis:names:tc:xacml:1.0:status:ok"
                }
            },
            "Resource": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:resource:resource-id",
                        "Value": "index.jsp",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "http://wso2.org/identity/user": {
                "Attribute": [
                    {
                        "AttributeId": "http://wso2.org/identity/user/username",
                        "Value": "adminUser",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            },
            "Action": {
                "Attribute": [
                    {
                        "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
                        "Value": "modify-welcome",
                        "IncludeInResult": "true",
                        "DataType": "http://www.w3.org/2001/XMLSchema#string"
                    }
                ]
            }
        }
    ]
}

在 XACML 的多决策配置文件中 - 结果将提供可以针对特定主题或资源所有者对资源采取的行动的所有决策组合。

“IncludeInResult”，属性会在响应中包含这些参数，你可以通过设置为false来缩短响应。

在 WSO2 身份服务器中，您可以添加自定义类别，如“http://wso2.org/identity/user”，用户声明为 AttributeId：如“http://wso2.org/identity/user/username”

WSO2 IS Multi-Decision Profile in JSON 支持 JSON 简化格式以及 XAML 标准 URI。你可以两个都试试。

例如：urn:oasis:names:tc:xacml:1.0:action:action-id -> action-id

【讨论】：