0

I'm using wso2is and trying to add new entitlement policy.It's configuration is as follws:

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"  PolicyId="EchoServicePolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Target>
      <AnyOf>
         <AllOf>
            <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
               <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
            </Match>
         </AllOf>
      </AnyOf>
   </Target>
   <Rule Effect="Permit" RuleId="Rule-1">
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
            <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"></Function>
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Umesha</AttributeValue>
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
         </Apply>
      </Condition>
   </Rule>
</Policy>

Now,at the time of test evaluation my request configuration is as:

Resource : *        
Subject Name : testRole
Action Name : read
Environment Name : *

When i click on test evaluate it showing Indeterminate.What is exact problem? is policy incorrect or their is problem during evaluation request? let me know..

Community
  • 1
  • 1
user3129056
  • 447
  • 3
  • 6
  • 19

1 Answers1

0

Your policy is correct. It must return permit.. when action is "read" and username is "Umesha". But in your request you are sending some other values. If you uses Subject name as "Umesha" You would see permit decision. However, If your name is some other value. I agree that You must return a "NotApplicable" result. Not "Indeterminate". But please check whether there are some other policies in the PDP policy store. Because then overall result can be changed. What is WSO2IS version that you are using? I just try out with your policy and request with 4.5.0. It returns "NotApplicable" which is correct.

Asela
  • 5,781
  • 1
  • 15
  • 23
  • Thanks for reply. I'm using wso2is-4.1.0 and It's working with subject name "Umesha" and with other value it showing "NotApplicable".Thanks again.. – user3129056 Feb 01 '14 at 05:00
  • Yes.. that it is fine.. BTW.. any reason for using 4.1.0 which is more than 1 year old. I suggest you to update for 4.5.0 or 4.6.0. Because there are some improvements in XACML space. you can check from here http://xacmlinfo.org/2013/09/13/getting-start-with-wso2-identity-server-4-5-0/ – Asela Feb 01 '14 at 11:57
  • Actually a have both of them but i used 4.1.0 just on trail basis.Right now i'm using 4.6.0 – user3129056 Feb 03 '14 at 04:33