XACML3.0核心文档资源-CSDN文库

需积分: 32 95 浏览量 2009-05-08 16:57:27 上传评论收藏 1.71MB DOC 举报

资源推荐

资源详情

资源评论

 
eXtensible Access Control Markup 
Language (XACML) Version 3.0
Working draft 087
35 November February 20089
Specification URIs:
This Version:
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].html
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].doc
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].pdf
Previous Version:
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].html
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].doc
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].pdf
Latest Version:
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].html
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].doc
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].pdf
Latest Approved Version:
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].html
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].doc
http://docs.oasis-open.org/[tc-short-name]/ [additional path/filename].pdf
Technical Committee:
OASIS eXtensible Access Control Markup Language (XACML) TC
Chairs:
Bill Parducci, <bill@parducci.net>
Hal Lockhart, BEA <hlockhar@bea.com>
Editor:
Erik Rissanen, Axiomatics AB <erik@axiomatics.com>
Related work:
This specification replaces or supercedes:
 [specifications replaced by this standard]
 [specifications replaced by this standard]
This specification is related to:
 [related specifications]
 [related specifications]
Declared XML Namespace(s):
urn:oasis:names:tc:xacml:3.0:core:schema:wd-087
Abstract:
This specification defines version 3.0 of the extensible access control markup language.
[Document Identifier] 53 November February 20089
Copyright © OASIS® 2007. All Rights Reserved. Page 1 of 158
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
1
2

Notices

All capitalized terms in the following text have the meanings assigned to them in the OASIS Intellectual

Property Rights Policy (the "OASIS IPR Policy"). The full Policy may be found at the OASIS website.

This document and translations of it may be copied and furnished to others, and derivative works that

comment on or otherwise explain it or assist in its implementation may be prepared, copied, published,

and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice

and this section are included on all such copies and derivative works. However, this document itself may

not be modified in any way, including by removing the copyright notice or references to OASIS, except as

needed for the purpose of developing any document or deliverable produced by an OASIS Technical

Committee (in which case the rules applicable to copyrights, as set forth in the OASIS IPR Policy, must

be followed) or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors

or assigns.

This document and the information contained herein is provided on an "AS IS" basis and OASIS

DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY

WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY

OWNERSHIP RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A

PARTICULAR PURPOSE.

OASIS requests that any OASIS Party or any other party that believes it has patent claims that would

necessarily be infringed by implementations of this OASIS Committee Specification or OASIS Standard,

to notify OASIS TC Administrator and provide an indication of its willingness to grant patent licenses to

such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that

produced this specification.

OASIS invites any party to contact the OASIS TC Administrator if it is aware of a claim of ownership of

any patent claims that would necessarily be infringed by implementations of this specification by a patent

holder that is not willing to provide a license to such patent claims in a manner consistent with the IPR

Mode of the OASIS Technical Committee that produced this specification. OASIS may include such

claims on its website, but disclaims any obligation to do so.

OASIS takes no position regarding the validity or scope of any intellectual property or other rights that

might be claimed to pertain to the implementation or use of the technology described in this document or

the extent to which any license under such rights might or might not be available; neither does it represent

that it has made any effort to identify any such rights. Information on OASIS' procedures with respect to

rights in any document or deliverable produced by an OASIS Technical Committee can be found on the

OASIS website. Copies of claims of rights made available for publication and any assurances of licenses

to be made available, or the result of an attempt made to obtain a general license or permission for the

use of such proprietary rights by implementers or users of this OASIS Committee Specification or OASIS

Standard, can be obtained from the OASIS TC Administrator. OASIS makes no representation that any

information or list of intellectual property rights will at any time be complete, or that any claims in such list

are, in fact, Essential Claims.

The names "OASIS", [insert specific trademarked names and abbreviations here] are trademarks of

OASIS, the owner and developer of this specification, and should be used only to refer to the organization

and its official outputs. OASIS welcomes reference to, and implementation and use of, specifications,

while reserving the right to enforce its marks against misleading uses. Please see http://www.oasis-

open.org/who/trademark.php for above guidance.

[Document Identifier] 53 November February 20089

100

101

Table of Contents
1  Introduction.............................................................................................................................................. 8
1.1  Glossary (non-normative)................................................................................................................. 8
1.1.1  Preferred terms......................................................................................................................... 8
1.1.2  Related terms.......................................................................................................................... 10
1.2  Terminology.................................................................................................................................... 10
1.3  Schema organization and namespaces..........................................................................................11
1.4  Normative References.................................................................................................................... 11
1.5  Non-Normative References............................................................................................................ 12
2  Background (non-normative)................................................................................................................. 13
2.1  Requirements................................................................................................................................. 13
2.2  Rule and policy combining.............................................................................................................. 14
2.3  Combining algorithms..................................................................................................................... 14
2.4  Multiple subjects............................................................................................................................. 15
2.5  Policies based on subject and resource attributes..........................................................................15
2.6  Multi-valued attributes..................................................................................................................... 15
2.7  Policies based on resource contents..............................................................................................15
2.8  Operators........................................................................................................................................ 16
2.9  Policy distribution............................................................................................................................ 16
2.10  Policy indexing.............................................................................................................................. 17
2.11  Abstraction layer........................................................................................................................... 17
2.12  Actions performed in conjunction with enforcement.....................................................................17
2.13  Supplemental information about a decision..................................................................................18
3  Models (non-normative)......................................................................................................................... 19
3.1  Data-flow model.............................................................................................................................. 19
3.2  XACML context............................................................................................................................... 20
3.3  Policy language model.................................................................................................................... 21
3.3.1  Rule......................................................................................................................................... 23
3.3.2  Policy....................................................................................................................................... 24
3.3.3  Policy set................................................................................................................................. 25
4  Examples (non-normative)..................................................................................................................... 27
4.1  Example one................................................................................................................................... 27
4.1.1  Example policy........................................................................................................................ 27
4.1.2  Example request context......................................................................................................... 28
4.1.3  Example response context...................................................................................................... 29
4.2  Example two................................................................................................................................... 30
4.2.1  Example medical record instance............................................................................................30
4.2.2  Example request context......................................................................................................... 31
4.2.3  Example plain-language rules................................................................................................. 32
4.2.4  Example XACML rule instances..............................................................................................33
5  Syntax (normative, with the exception of the schema fragments)..........................................................45
5.1  Element <PolicySet>...................................................................................................................... 45
5.2  Element <Description>...................................................................................................................47
[Document Identifier] 53 November February 20089
Copyright © OASIS® 2007. All Rights Reserved. Page 4 of 158
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
10
11

5.3  Element <PolicyIssuer>.................................................................................................................. 47
5.4  Element <PolicySetDefaults>.........................................................................................................47
5.5  Element <XPathVersion>...............................................................................................................48
5.6  Element <Target>........................................................................................................................... 48
5.7  Element <AnyOf>........................................................................................................................... 48
5.8  Element <AllOf>............................................................................................................................. 49
5.9  Element <Match>........................................................................................................................... 49
5.10  Element <PolicySetIdReference>.................................................................................................50
5.11  Element <PolicyIdReference>...................................................................................................... 50
5.12  Simple type VersionType..............................................................................................................50
5.13  Simple type VersionMatchType....................................................................................................51
5.14  Element <Policy>.......................................................................................................................... 51
5.15  Element <PolicyDefaults>............................................................................................................. 53
5.16  Element <CombinerParameters>................................................................................................. 53
5.17  Element <CombinerParameter>...................................................................................................54
5.18  Element <RuleCombinerParameters>..........................................................................................54
5.19  Element <PolicyCombinerParameters>........................................................................................55
5.20  Element <PolicySetCombinerParameters>..................................................................................55
5.21  Element <Rule>............................................................................................................................ 56
5.22  Simple type EffectType................................................................................................................. 57
5.23  Element <VariableDefinition>....................................................................................................... 57
5.24  Element <VariableReference>......................................................................................................57
5.25  Element <Expression>.................................................................................................................. 58
5.26  Element <Condition>.................................................................................................................... 58
5.27  Element <Apply>.......................................................................................................................... 58
5.28  Element <Function>...................................................................................................................... 59
5.29  Element <AttributeDesignator>..................................................................................................... 59
5.30  Element <AttributeSelector>.........................................................................................................60
5.31  Element <AttributeValue>.............................................................................................................62
5.32  Element <Obligations>.................................................................................................................62
5.33  Element <AssociatedAdvice>.......................................................................................................63
5.34  Element <Obligation>................................................................................................................... 63
5.35  Element <Advice>........................................................................................................................ 63
5.36  Element <AttributeAssignment>................................................................................................... 64
5.37  Element <ObligationExpressions>................................................................................................64
5.38  Element <AdviceExpressions>.....................................................................................................65
5.39  Element <ObligationExpression>.................................................................................................65
5.40  Element <AdviceExpression>....................................................................................................... 65
5.41  Element <AttributeAssignmentExpression>..................................................................................66
5.42  Element <Request>...................................................................................................................... 66
5.43  Element <RequestDefaults>.........................................................................................................67
5.44  Element <Attributes>.................................................................................................................... 67
5.45  Element <Content>....................................................................................................................... 68
5.46  Element <Attribute>...................................................................................................................... 68
5.47  Element <Response>................................................................................................................... 69
[Document Identifier] 53 November February 20089
Copyright © OASIS® 2007. All Rights Reserved. Page 5 of 158
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
43
44