OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

xacml message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]


Subject: [xacml] Conformance test cases


Attached is an html document listing my proposed conformance test
cases.  Before I get too far on creating the test documents for
each case, I would appreciate some feedback.

Is this list too thorough?  If so, what should be cut?
Is this list not thorough enough?  Remember, we never promised an
  exhaustive test suite.  If you answer yes to this question, you
  are probably going to get the job of making it more thorough.
Are there particular test cases that should be added?  What are
they?

I plan to develop the tests for mandatory functionality.  I will
roll them out gradually so I can get feedback from implementors.

I do not plan to develop the tests for non-mandatory
functionality.  If one of these areas is important to you or your
organization, I invite you to volunteer for developing the tests
for those test cases.

Anne
-- 
Anne H. Anderson             Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692

Title: XACML Conformance Tests

XACML Conformance Tests

Version: %I%, %E% (yy/mm/dd) Author: Anne Anderson Source: %P%

Contents


  1. Description of tests
  2. Tests are divided into those that exercise Mandatory-to-Implement functionality and those that exercise Optional functionality. All conforming implementations MUST support all Mandatory-to-Implement functionality. Conforming implementations MAY support specific Optional functionality areas.

    Tests are divided into groups based on the primary area of functionality or schema being exercised.

  3. An XACML Request
  4. An XACML Policy or set of Policy documents
  5. An XACML Response

A conforming implementation of an XACML Policy Decision Point (PDP) must be able to:

  1. Accept the given Request as input
  2. Accept the given Policy as input
  3. Produce the given Response as output

A conforming implementation of an XACML Policy Administration Point (PAP) must be able to generate each given XACML Policy example except for those marked INVALID.


  • Mandatory-to-Implement Functionality Tests
    1. Attribute References
    2. These tests exercise referencing of attribute values in the Request by a policy.

      1. Case: Simple type attribute element present in Request
      2. Case: Simple type attribute element not present in Request, but retrievable by Attribute Authority
      3. Case: Simple type attribute element not present in Request and not retrievable by Attribute Authority
      4. Case: INVALID syntax for Attribute Selector
      5. Case: INVALID syntax for Request attribute

    3. Target Matching
    4. These tests exercise various forms of Target matching.
      1. Case: match: anySubject, anyResource, anyAction
      2. Case: match: anySubject, anyResource, specified action
      3. Case: no match: anySubject, anyResource, specified action
      4. Case: match: specific Subject type
      5. Case: no match: specific Subject type
      6. Case: match: specific Subject identifier
      7. Case: no match: specific Subject identifier
      8. Case: match: specific Subject attribute
      9. Case: no match: specific Subject attribute
      10. Case: match: specific Subject identifier and attribute
      11. Case: no match: specific Subject identifier and attribute
      12. Case: match: specific resource
      13. Case: no match: specific resource
      14. Case: match: impliedAction
      15. Case: no match: impliedAction
      16. Case: match: specific action
      17. Case: no match: specific action

    5. Function Evaluation
      1. Case: true: Condition Evaluation
      2. Case: false: Condition Evaluation
      3. Case: Condition Evaluation - non-boolean datatype
      4. Case: function:integer-add
      5. Case: function:integer-add - non-integer datatype
      6. Case: function:decimal-add
      7. Case: function:add-dayTimeDuration-to-time
      8. Case: function:add-dayTimeDuration-to-dateTime
      9. Case: function:add-yearMonthDurations
      10. Case: function:add-dayTimeDurations
      11. Case: function:integer-subtract
      12. Case: function:decimal-subtract
      13. Case: function:time-subtract
      14. Case: function:subtract-dayTimeDuration-from-time
      15. Case: function:subtract-yearMonthDurations
      16. Case: function:subtract-dayTimeDurations
      17. Case: function:integer-multiply
      18. Case: function:decimal-multiply
      19. Case: function:multiply-yearMonthDurations
      20. Case: function:multiply-dayTimeDurations
      21. Case: function:numeric-divide
      22. Case: function:divide-yearMonthDurations
      23. Case: function:divide-dayTimeDurations
      24. Case: function:integer-mod
      25. Case: function:decimal-mod
      26. Case: function:round
      27. Case: function:floor
      28. Case: function:decimal
      29. Case: true: function:integer-equal
      30. Case: false: function:integer-equal
      31. Case: true: function:decimal-equal
      32. Case: false: function:decimal-equal
      33. Case: true: function:boolean-equal
      34. Case: false: function:boolean-equal
      35. Case: true: function:string-equal: literal string
      36. Case: true: function:string-equal: regExp
      37. Case: false: function:string-equal: literal string
      38. Case: false: function:string-equal: regExp string
      39. Case: true: function:xpath-equal
      40. Case: false: function:xpath-equal
      41. Case: true: function:rfc822Name-equal
      42. Case: true: function:rfc822Name-equal - dominance
      43. Case: false: function:rfc822Name-equal
      44. Case: false: function:rfc822Name-equal - dominance
      45. Case: true: function:x500Name-equal
      46. Case: true: function:x500Name-equal - dominance
      47. Case: false: function:x500Name-equal
      48. Case: false: function:x500Name-equal - dominance
      49. Case: true: function:date-equal
      50. Case: false: function:date-equal
      51. Case: true: function:time-equal
      52. Case: false: function:time-equal
      53. Case: true: function:datetime-equal
      54. Case: false: function:datetime-equal
      55. Case: true: function:yearMonthDuration-equal
      56. Case: false: function:yearMonthDuration-equal
      57. Case: true: function:dayTimeDuration-equal
      58. Case: false: function:dayTimeDuration-equal
      59. Case: true: function:gregorian-equal
      60. Case: false: function:gregorian-equal
      61. Case: true: function:hex-binary-equal
      62. Case: false: function:hex-binary-equal
      63. Case: true: function:base64-binary-equal
      64. Case: false: function:base64-binary-equal
      65. Case: true: function:anyURI-equal
      66. Case: false: function:anyURI-equal
      67. Case: true: function:QName-equal
      68. Case: false: function:QName-equal
      69. Case: true: function:NOTATION-equal
      70. Case: false: function:NOTATION-equal
      71. Case: true: function:integer-greater-than
      72. Case: false: function:integer-greater-than
      73. Case: true: function:decimal-greater-than
      74. Case: false: function:decimal-greater-than
      75. Case: true: function:boolean-greater-than
      76. Case: false: function:boolean-greater-than
      77. Case: true: function:string-greater-than
      78. Case: false: function:string-greater-than
      79. Case: true: function:date-greater-than
      80. Case: false: function:date-greater-than
      81. Case: true: function:time-greater-than
      82. Case: false: function:time-greater-than
      83. Case: true: function:datetime-greater-than
      84. Case: false: function:datetime-greater-than
      85. Case: true: function:yearMonthDuration-greater-than
      86. Case: false: function:yearMonthDuration-greater-than
      87. Case: true: function:dayTimeDuration-greater-than
      88. Case: false: function:dayTimeDuration-greater-than
      89. Case: true: function:integer-greater-than-or-equal
      90. Case: false: function:integer-greater-than-or-equal
      91. Case: true: function:decimal-greater-than-or-equal
      92. Case: false: function:decimal-greater-than-or-equal
      93. Case: true: function:string-greater-than-or-equal
      94. Case: false: function:string-greater-than-or-equal
      95. Case: true: function:date-greater-than-or-equal
      96. Case: false: function:date-greater-than-or-equal
      97. Case: true: function:time-greater-than-or-equal
      98. Case: false: function:time-greater-than-or-equal
      99. Case: true: function:datetime-greater-than-or-equal
      100. Case: false: function:datetime-greater-than-or-equal
      101. Case: true: function:yearMonthDuration-greater-than-or-equal
      102. Case: false: function:yearMonthDuration-greater-than-or-equal
      103. Case: true: function:dayTimeDuration-greater-than-or-equal
      104. Case: false: function:dayTimeDuration-greater-than-or-equal
      105. Case: true: function:string-match: literal string
      106. Case: true: function:string-match: regExp
      107. Case: false: function:string-match: literal string
      108. Case: false: function:string-match: regExp
      109. Case: true: function:and
      110. Case: false: function:and
      111. Case: true: function:or
      112. Case: false: function:or
      113. Case: true: function:ordered-or
      114. Case: false: function:ordered-or
      115. Case: true: function:n-of
      116. Case: false: function:n-of
      117. Case: true: function:not
      118. Case: false: function:not
      119. Case: true: function:present
      120. Case: false: function:present
      121. Case: true: function:subset
      122. Case: false: function:subset
      123. Case: true: function:superset
      124. Case: false: function:superset
      125. Case: true: function:non-null-set-intersection
      126. Case: false: function:non-null-set-intersection

    6. Combining Algorithms
      1. Case: true: DenyOverrides
      2. Case: false: DenyOverrides
      3. Case: true: PermitOverrides
      4. Case: false: PermitOverrides

    7. Designators
      1. Case: RuleDesignator
      2. Case: PolicyStatementDesignator
      3. Case: PolicySetStatementDesignator
      4. Case: PolicyStatement inside Assertion
      5. Case: PolicySetStatement inside Assertion

  • Optional Functionality Tests
    1. Obligations

    2. Multiple Decisions

    3. Protecting XML documents
      1. Case: AttributeDesignator pointing into XML document
      2. Case: Resource as subspace of an XML document

    4. Non-mandatory Functions
    5. Durations

      1. Case: function:add-dayTimeDuration-to-date
      2. Case: function:add-yearMonthDuration-to-date
      3. Case: function:add-yearMonthDuration-to-dateTime
      4. Case: function:add-dayTimeDuration-to-dateTime
      5. Case: function:subtract-yearMonthDuration-from-date
      6. Case: function:subtract-dayTimeDuration-from-date
      7. Case: function:date-subtract
      8. Case: function:datetime-subtract
      9. Case: function:subtract-yearMonthDuration-from-dateTime
      10. Case: function:subtract-dayTimeDuration-from-dateTime

    6. Non-standard Combining Algorithms

    Anne Anderson
    Last modified: Tue Jul 23 14:55:32 EDT 2002

    [Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]


    Powered by eList eXpress LLC