XACML策略中的分层属性 [英] Hierarchical attributes in XACML Policy

问题描述

我们正在使用WSO2 Identity Server 5.1.0.

We are using WSO2 Identity Server 5.1.0 .

我们有一个类似于Plant1-> Area1-> unit1的位置层次结构.现在，如果用户具有Plant1的属性，那么他也应该可以访问unit1(树中父级的所有子级).

We have a location hierarchy like Plant1->Area1->unit1. Now if a user is having attribute for the Plant1, he should get access to unit1 as well (all children of the parent in a tree).

我们可以在XACML中指定吗?我们将层次结构存储在数据库中.如果需要，我们也可以提供层次结构元素列表作为属性列表.

Can we specify this in XACML? We have the hierarchy stored in DB. We can provide the list of hierarchical elements as a list of attributes also if so required.

示例中说明的问题:用户鲍勃已被授予对area2的访问权限，如下所示:

Problem explained in sample : A user bob has been given access to area2 as shown below :

Plant1

| --Area1

|--Area1

     |--Unit1

| --Area2

|--Area2

     |--Unit2

我们要在XACML策略中指定Area2位置.现在，如果带有area2或unit2的请求应被允许，而如果带有plant1，area1或unit1的请求应被拒绝.

We want to specify the Area2 location in XACML policy. Now if the request with area2 or unit2 comes that should be permitted while if the request with plant1, area1 or unit1 comes that should get denied.

我需要XACML策略的结构.

I need the structure for XACML policy.

推荐答案

您可以在诸如

You can implement this with a custom PIP (Policy Information Point, aka Attribute Provider) in XACML implementations like AuthzForce. I don't know WSO2 IS as much but according to the doc, it is also extensible with custom PIPs, so I assume this should do the trick.

这个想法是，在XACML策略中，您可以使用带有自定义AttributeId的AttributeDesignator来指示请求某个属性的层次结构中的顶级父值，例如AttributeId = resource-id-parent 表示 resource-id 属性值的父值.

The idea is that in the XACML Policy, you use an AttributeDesignator with a custom AttributeId to indicate that the top parent value in the hierarchy of some attribute is requested, e.g. AttributeId = resource-id-parent for the parent value of resource-id attribute value.

自定义PIP的功能:当请求此自定义属性ID resource-id-parent 时，PIP从请求中获取属性 resource-id 的值，即"area2"或"unit2"，然后从您的数据库中获取层次结构中的相应最高值(或者，如果愿意，则可以获取上述所有值)，并将其作为bag返回.然后，在XACML策略中，您可以在Match中使用字符串等于或在Condition中使用字符串至少为一的成员，以将AttributeDesignator与"area2"进行匹配(请记住，AttributeDesignator始终对包进行求值).

What your custom PIP does: when this custom attribute id resource-id-parent is requested, the PIP gets the value of the attribute resource-id from the request, i.e. "area2" or "unit2", then gets the corresponding top value in the hierarchy from your DB (or all the values above if you will) and return it as bag. Then, in the XACML Policy, you can use string-equal in a Match or string-at-least-one-member-of in a Condition to match the AttributeDesignator with "area2" (remember an AttributeDesignator always evaluate to a bag).

这篇关于XACML策略中的分层属性的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！