@@ -119,24 +119,41 @@ has been provided and that the `role=security-role-0000-0000-000000000000` :
119
119
<AllOf >
120
120
<Match MatchId =" urn:oasis:names:tc:xacml:1.0:function:string-equal" >
121
121
<AttributeValue DataType =" http://www.w3.org/2001/XMLSchema#string" >/bell/ring</AttributeValue >
122
- <AttributeDesignator Category =" urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId =" urn:thales:xacml:2.0:resource:sub-resource-id" DataType =" http://www.w3.org/2001/XMLSchema#string" MustBePresent =" true" />
122
+ <AttributeDesignator
123
+ Category =" urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
124
+ AttributeId =" urn:thales:xacml:2.0:resource:sub-resource-id"
125
+ DataType =" http://www.w3.org/2001/XMLSchema#string"
126
+ MustBePresent =" true"
127
+ />
123
128
</Match >
124
129
</AllOf >
125
130
</AnyOf >
126
131
<AnyOf >
127
132
<AllOf >
128
133
<Match MatchId =" urn:oasis:names:tc:xacml:1.0:function:string-equal" >
129
134
<AttributeValue DataType =" http://www.w3.org/2001/XMLSchema#string" >POST</AttributeValue >
130
- <AttributeDesignator Category =" urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId =" urn:oasis:names:tc:xacml:1.0:action:action-id" DataType =" http://www.w3.org/2001/XMLSchema#string" MustBePresent =" true" />
135
+ <AttributeDesignator
136
+ Category =" urn:oasis:names:tc:xacml:3.0:attribute-category:action"
137
+ AttributeId =" urn:oasis:names:tc:xacml:1.0:action:action-id"
138
+ DataType =" http://www.w3.org/2001/XMLSchema#string"
139
+ MustBePresent =" true"
140
+ />
131
141
</Match >
132
142
</AllOf >
133
143
</AnyOf >
134
144
</Target >
135
145
<Condition >
136
146
<Apply FunctionId =" urn:oasis:names:tc:xacml:3.0:function:any-of" >
137
147
<Function FunctionId =" urn:oasis:names:tc:xacml:1.0:function:string-equal" />
138
- <AttributeValue DataType =" http://www.w3.org/2001/XMLSchema#string" >security-role-0000-0000-000000000000</AttributeValue >
139
- <AttributeDesignator Category =" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId =" urn:oasis:names:tc:xacml:2.0:subject:role" DataType =" http://www.w3.org/2001/XMLSchema#string" MustBePresent =" false" />
148
+ <AttributeValue
149
+ DataType =" http://www.w3.org/2001/XMLSchema#string"
150
+ >security-role-0000-0000-000000000000</AttributeValue >
151
+ <AttributeDesignator
152
+ Category =" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
153
+ AttributeId =" urn:oasis:names:tc:xacml:2.0:subject:role"
154
+ DataType =" http://www.w3.org/2001/XMLSchema#string"
155
+ MustBePresent =" false"
156
+ />
140
157
</Apply >
141
158
</Condition >
142
159
</Rule >
@@ -503,17 +520,19 @@ curl -X GET \
503
520
The response returns information about the version of Authzforce.
504
521
505
522
` ` ` xml
506
- <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
507
- <productMetadata xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
508
- xmlns:ns2="http://www.w3.org/2005/Atom"
509
- xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
510
- xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
511
- xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"
512
- name="AuthzForce CE Server"
513
- version="8.0.1"
514
- release_date="2017-12-05"
515
- uptime="P0Y0M0DT0H8M47.642S"
516
- doc="https://authzforce.github.io/fiware/authorization-pdp-api-spec/5.2/"/>
523
+ <?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
524
+ <productMetadata
525
+ xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
526
+ xmlns:ns2="http://www.w3.org/2005/Atom"
527
+ xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
528
+ xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
529
+ xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"
530
+ name="AuthzForce CE Server"
531
+ version="8.0.1"
532
+ release_date="2017-12-05"
533
+ uptime="P0Y0M0DT0H8M47.642S"
534
+ doc="https://authzforce.github.io/fiware/authorization-pdp-api-spec/5.2/"
535
+ />
517
536
` ` `
518
537
519
538
# Using an XACML Server
@@ -550,13 +569,15 @@ The response lists the domains which are available in **Authzforce**. This corre
550
569
uploaded to **Authzforce** on start-up.
551
570
552
571
` ` ` xml
553
- <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
554
- <resources xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
555
- xmlns:ns2="http://www.w3.org/2005/Atom"
556
- xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
557
- xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
558
- xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6">
559
- <ns2:link rel="item" href="gQqnLOnIEeiBFQJCrBIBDA" title="gQqnLOnIEeiBFQJCrBIBDA"/>
572
+ <?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
573
+ <resources
574
+ xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
575
+ xmlns:ns2="http://www.w3.org/2005/Atom"
576
+ xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
577
+ xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
578
+ xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"
579
+ >
580
+ <ns2:link rel="item" href="gQqnLOnIEeiBFQJCrBIBDA" title="gQqnLOnIEeiBFQJCrBIBDA" />
560
581
</resources>
561
582
` ` `
562
583
@@ -580,18 +601,19 @@ The response lists more information about the domain, including the ID used with
580
601
(`tutorial-dckr-site-0000-xpresswebapp`)
581
602
582
603
` ` ` xml
583
- <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
584
- <domain xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
585
- xmlns:ns2="http://www.w3.org/2005/Atom"
586
- xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
587
- xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
588
- xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6">
589
- <properties externalId="tutorial-dckr-site-0000-xpresswebapp"/>
604
+ <?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
605
+ <domain
606
+ xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
607
+ xmlns:ns2="http://www.w3.org/2005/Atom"
608
+ xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
609
+ xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
610
+ xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"
611
+ >
612
+ <properties externalId="tutorial-dckr-site-0000-xpresswebapp" />
590
613
<childResources>
591
- <ns2:link rel="item" href="/properties" title="Domain properties"/>
592
- <ns2:link rel="item" href="/pap" title="Policy Administration Point"/>
593
- <ns2:link rel="http://docs.oasis-open.org/ns/xacml/relation/pdp"
594
- href="/pdp" title="Policy Decision Point"/>
614
+ <ns2:link rel="item" href="/properties" title="Domain properties" />
615
+ <ns2:link rel="item" href="/pap" title="Policy Administration Point" />
616
+ <ns2:link rel="http://docs.oasis-open.org/ns/xacml/relation/pdp" href="/pdp" title="Policy Decision Point" />
595
617
</childResources>
596
618
</domain>
597
619
` ` `
@@ -615,14 +637,16 @@ The response returns a list of available revisions of the given policy which are
615
637
container. This corresponds the named XML files `1.xml`, `2.xml` etc.
616
638
617
639
` ` ` xml
618
- <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
619
- <resources xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
620
- xmlns:ns2="http://www.w3.org/2005/Atom"
621
- xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
622
- xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
623
- xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6">
624
- <ns2:link rel="item" href="f8194af5-8a07-486a-9581-c1f05d05483c"/>
625
- <ns2:link rel="item" href="root"/>
640
+ <?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
641
+ <resources
642
+ xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
643
+ xmlns:ns2="http://www.w3.org/2005/Atom"
644
+ xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
645
+ xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
646
+ xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"
647
+ >
648
+ <ns2:link rel="item" href="f8194af5-8a07-486a-9581-c1f05d05483c" />
649
+ <ns2:link rel="item" href="root" />
626
650
</resources>
627
651
` ` `
628
652
@@ -646,14 +670,16 @@ The response returns a list of available revisions of the given policy which are
646
670
container. This corresponds the named XML files `1.xml`, `2.xml` etc.
647
671
648
672
` ` ` xml
649
- <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
650
- <resources xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
651
- xmlns:ns2="http://www.w3.org/2005/Atom"
652
- xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
653
- xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
654
- xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6">
655
- <ns2:link rel="item" href="2"/>
656
- <ns2:link rel="item" href="1"/>
673
+ <?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
674
+ <resources
675
+ xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
676
+ xmlns:ns2="http://www.w3.org/2005/Atom"
677
+ xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
678
+ xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
679
+ xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"
680
+ >
681
+ <ns2:link rel="item" href="2" />
682
+ <ns2:link rel="item" href="1" />
657
683
</resources>
658
684
` ` `
659
685
@@ -677,18 +703,26 @@ The response contains the full `<PolicySet>` for the given revision. This is a c
677
703
held within **Authzforce**.
678
704
679
705
` ` ` xml
680
- <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
681
- <ns3:PolicySet xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
682
- xmlns:ns2="http://www.w3.org/2005/Atom"
683
- xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
684
- xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
685
- xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6" PolicySetId="f8194af5-8a07-486a-9581-c1f05d05483c" Version="2" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-unless-permit">
706
+ <?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
707
+ <ns3:PolicySet
708
+ xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
709
+ xmlns:ns2="http://www.w3.org/2005/Atom"
710
+ xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
711
+ xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
712
+ xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"
713
+ PolicySetId="f8194af5-8a07-486a-9581-c1f05d05483c"
714
+ Version="2"
715
+ PolicyCombiningAlgId="urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-unless-permit"
716
+ >
686
717
<ns3:Description>Policy Set for application tutorial-dckr-site-0000-xpresswebapp</ns3:Description>
687
- <ns3:Target/>
688
- <ns3:Policy PolicyId="security-role-0000-0000-000000000000"
689
- Version="1.0"
690
- RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-unless-permit">
691
- <ns3:Description>Role security-role-0000-0000-000000000000 from application tutorial-dckr-site-0000-xpresswebapp</ns3:Description>
718
+ <ns3:Target />
719
+ <ns3:Policy
720
+ PolicyId="security-role-0000-0000-000000000000"
721
+ Version="1.0"
722
+ RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-unless-permit"
723
+ >
724
+ <ns3:Description
725
+ >Role security-role-0000-0000-000000000000 from application tutorial-dckr-site-0000-xpresswebapp</ns3:Description>
692
726
<ns3:Target>
693
727
...etc
694
728
</ns3:Target>
@@ -760,12 +794,14 @@ The `managers-role-0000-0000-000000000000` permits access to the `/app/price-cha
760
794
successful request includes a `<Decision>` element to `Permit` access to the resource.
761
795
762
796
` ` ` xml
763
- <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
764
- <ns3:Response xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
765
- xmlns:ns2="http://www.w3.org/2005/Atom"
766
- xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
767
- xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
768
- xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6">
797
+ <?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
798
+ <ns3:Response
799
+ xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
800
+ xmlns:ns2="http://www.w3.org/2005/Atom"
801
+ xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
802
+ xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
803
+ xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"
804
+ >
769
805
<ns3:Result>
770
806
<ns3:Decision>Permit</ns3:Decision>
771
807
</ns3:Result>
@@ -813,12 +849,14 @@ The `security-role-0000-0000-000000000000` does not permit access to the `/app/p
813
849
an unsuccessful request includes a `<Decision>` element which will `Deny` access to the resource.
814
850
815
851
` ` ` xml
816
- <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
817
- <ns3:Response xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
818
- xmlns:ns2="http://www.w3.org/2005/Atom"
819
- xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
820
- xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
821
- xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6">
852
+ <?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
853
+ <ns3:Response
854
+ xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
855
+ xmlns:ns2="http://www.w3.org/2005/Atom"
856
+ xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
857
+ xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
858
+ xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"
859
+ >
822
860
<ns3:Result>
823
861
<ns3:Decision>Deny</ns3:Decision>
824
862
</ns3:Result>
@@ -976,12 +1014,14 @@ curl -X POST \
976
1014
The response includes a `<Decision>` element which will either `Permit` or `Deny` the request.
977
1015
978
1016
` ` ` xml
979
- <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
980
- <ns3:Response xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
981
- xmlns:ns2="http://www.w3.org/2005/Atom"
982
- xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
983
- xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
984
- xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6">
1017
+ <?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
1018
+ <ns3:Response
1019
+ xmlns="http://authzforce.github.io/rest-api-model/xmlns/authz/5"
1020
+ xmlns:ns2="http://www.w3.org/2005/Atom"
1021
+ xmlns:ns3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
1022
+ xmlns:ns4="http://authzforce.github.io/core/xmlns/pdp/6.0"
1023
+ xmlns:ns5="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"
1024
+ >
985
1025
<ns3:Result>
986
1026
<ns3:Decision>Permit</ns3:Decision>
987
1027
</ns3:Result>
0 commit comments