Comparing specific custom-defined attribute of user

Question

For an XACML policy document I had in mind, I have a subject (user) and an object, each attached with a label. Let's call this myLabel = {[a,b,c], [1,2,3]}. I wish to do a comparison of parts of this label.

How can I define a subject and object to contain this label in the access request and policy to formulate a decision to compare this?

I wish to use XML rather than JSON or ALFA to declare the above.

Just to clarify, do you mean that each label is a set of 2 arrays or just one for subject and one for object, for instance: subject has label [a, b, c] and object has label [1, 2, 3] and decision is PERMIT if and only if a=1, b=2, c=3? Could you detail the comparison algorithm on labels that you want with example that should result in PERMIT decision? — cdan, May 26 '19 at 20:57
@CyrilDangerville subject and object both have label `{[a,b,c],[1,2,3]}`. An example rule of this label (out of many) could be that `subject-label[][2] = 3 > object-label[][1] = 2` -- which results in PERMIT — rshah, May 27 '19 at 11:04
There is no out-of-the-box datatype for such label structure in the XACML standard, as David mentioned in his answer. Still, making your own may be overkill. Simpler alternative: make it two XACML attributes with standard datatypes: a string (bag) attribute for the first part of label, e.g. `[a,b,c]` (named `label-strings`?); and a integer (bag) attribute for the second part, e.g. [1,2,3] (named `label-ints`?). I let you suggest better names for these, then I could write a XACML policy based on your suggestions. — cdan, May 31 '19 at 01:38

score 2 · Answer 1 · answered May 29 '19 at 20:58

XACML (and ALFA) comes with a set of clearly defined data types and functions. For instance XACML defines the following datatypes:

string
integer
boolean
date...

There are 18 or so datatypes out-of-the-box.

To work on those datatypes, XACML defines hundreds of functions such as:

string-equal
string-greater-than
integer-equal
...

Attributes in XACML (e.g. label or role or department) must have a datatype. Attributes can be multi-valued. In other words, role = ["manager"] or role = ["manager", "employee", "janitor"]. Both are perfectly valid.

In your case, you are referring to a value structured as follows: {[a,b,c],[1,2,3]}. This is not a standard datatype. It's a complex object and as such would require further processing (in a PEP? in a PIP?). How were you thinking of passing it to the PDP?

Let's assume we have simple values e.g. label = '2'. To compare a user's label to a resource's label and grant access if they are equal, you would write the following:

ALFA

    /**
     * Control access based on labels
     */
    policy labelAccessControl{
        apply firstApplicable
        rule allowIfSameLabel{
            permit
            condition user.label == object.label
        }

    }

XACML XML equivalent

<?xml version="1.0" encoding="UTF-8"?><!--This file was generated by the 
    ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com). --><!--Any modification to this file will 
    be lost upon recompilation of the source ALFA file -->
<xacml3:Policy
    xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="http://axiomatics.com/alfa/identifier/com.axiomatics.labelAccessControl"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
    Version="1.0">
    <xacml3:Description>Control access based on labels</xacml3:Description>
    <xacml3:PolicyDefaults>
        <xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116
        </xacml3:XPathVersion>
    </xacml3:PolicyDefaults>
    <xacml3:Target />
    <xacml3:Rule Effect="Permit"
        RuleId="com.axiomatics.labelAccessControl.allowIfSameLabel">
        <xacml3:Description />
        <xacml3:Target />
        <xacml3:Condition>
            <xacml3:Apply
                FunctionId="urn:oasis:names:tc:xacml:3.0:function:any-of-any">
                <xacml3:Function
                    FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal" />
                <xacml3:AttributeDesignator
                    AttributeId="com.axiomatics.user.label"
                    Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    MustBePresent="false" />
                <xacml3:AttributeDesignator
                    AttributeId="com.axiomatics.object.label"
                    Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                    DataType="http://www.w3.org/2001/XMLSchema#string"
                    MustBePresent="false" />
            </xacml3:Apply>
        </xacml3:Condition>
    </xacml3:Rule>
</xacml3:Policy>

Thanks for the great answer! I was planning on evaluating the label in the PDP. I was wondering if it was possible to specify a schema for the label since its a complex type, and then be able to compare the parts of the label. — rshah, May 30 '19 at 11:55
Yes you can extend the language with new datatypes and functions — David Brossard, May 30 '19 at 12:30
Could you provide an example on how I could go about doing this? — rshah, May 30 '19 at 13:34

Comparing specific custom-defined attribute of user

1 Answers1

ALFA

XACML XML equivalent