Re: [xacml-users] Expression Policies that require user attributes in a geneneral way

[Argyn <jawabean@gmail.com>]

Rupert

i think you can use something like this:


<Condition>
  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-match">
    <Apply
        FunctionId="urn:oasis:names:tc:xacml:
1.0:function:string-one-and-only">
      <SubjectAttributeDesignator AttributeId="name" DataType="
http://www.w3.org/2001/XMLSchema#string"/>
    </Apply>

  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-match">
    <Apply
        FunctionId="urn:oasis:names:tc:xacml:
1.0:function:string-one-and-only">
 <ResourceAttributeDesignator AttributeId="resource-id" DataType="
http://www.w3.org/2001/XMLSchema#string"/>
    </Apply>

 </Apply>
</Condition>

i didn't test this, so this may not be correct syntaxically, but you got the
idea. i'm using xacml 2.0 syntax, if u r in 1.0, u may need to convert this
back

argyn



I am having trouble constructing a Condition Function in a Rule base on
> a variable attribute of a Subject.
>
> Thanks,
>
> Rupert
>
>
>
> --
> Rupert Webb
> Software Engineer
> LimeBrokerage
>
> rwebb@limebrokerage.com
> Work: 781-472-3756
> Cell: 617-257-4447
>
> ----------------------------------------------------------
> This mail sent through IMP: https://webmail.limegroup.com/
>
> ---------------------------------------------------------------------
> This publicly archived list supports open discussion on using the
> XACML OASIS Standard. To minimize spam in the archives, you
> must subscribe before posting.
>
> [Un]Subscribe/change address: http://www.oasis-open.org/mlmanage/
> Alternately, using email: list-[un]subscribe@lists.oasis-open.org
> List archives: http://lists.oasis-open.org/archives/xacml-users/
> Committee homepage: http://www.oasis-open.org/committees/xacml/
> List Guidelines: http://www.oasis-open.org/maillists/guidelines.php
> Join OASIS: http://www.oasis-open.org/join/
>
>