Fine grained access control with XACML 3.0 for an XML document

Question

I want to express a fine-grained access control use case with XACML 3.0 for an XML document but I don't know whether I can use a full XPath expression like

for $a in fn:distinct-values(sales/clientid)return (fn:sum(sales[clientid = $a]/value)

This my XML:

<?xml version="1.0"?>
<database>
    <sales>
        <salesid>1</salesid>
        <clientid>1</clientid>
        <value>1000</value>
    </sales>
    <sales>
        <salesid>2</salesid>
        <clientid>1</clientid>
        <value>10000</value>
    </sales>
    <sales>
        <salesid>3</salesid>
        <clientid>2</clientid>
        <value>500</value>
    </sales>
    <client>
        <clientid>1</clientid>
        <nom>a</nom>
    </client>
    <client>
        <clientid>2</clientid>
        <nom>b</nom>
    </client>
</database>

How can I limit the access to the clients who have a sales value less than 10,000?

Answer 1

As I understand your requirement, you need to apply XACML policy based on the xml schema as described above. The sample xml needed to be in XACML request else if you are planning to read from xml as repository you may need to write a custom PIP.

You can achieve the XPath based policy design for the same, provided that the xml input for the client details is available in XACML request inside element as below sample:

<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
 <Content>
  <client id="xxxx">
   <sales id="yyyy">
    <value>1234</value>
   </sales>
  </client>
 </Content>
</Attributes>

Then you can create the policy based for your use case as below sample:

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" xmlns:xacml="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="sample-xpath-policy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"         Version="1.0">
<Description>Sample XPath policy</Description>
<PolicyDefaults>
<XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</XPathVersion>
</PolicyDefaults>
<Rule Effect="Permit" RuleId="Rule-1">
<Target>
<AnyOf>
<AllOf>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:integer-less-than">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#integer">10000</AttributeValue><AttributeSelector MustBePresent="false" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"  Path="/client/sales/value/text()" DataType="http://www.w3.org/2001/XMLSchema#integer"/>
</Match>
</AllOf>
</AnyOf>
</Target>
</Rule>
<Rule RuleId="rule2" Effect="Deny">
<Description>Deny rule</Description>
</Rule>
</Policy>