XACML condition comparing subject attribute and resource attribute, not hard coded - authorization

Question

I am working on a policy in XACML where a subject with security classification and category, should be compared with an object's classification and category.
The request could be:
Subject:
classification: Secret,
category: Nato, EU.
Resource:
classification: Secret,
category: Nato.
This should be permit.
If the resource has higher classification than the subject, or the subject don't have the correct category, the result should be denied. So, I need to somehow rank the classifications (with the function in-bag?) to see if the subject has the correct ones. I also need to compare the subject's and the object's one or more categories to each other.
I can only make it work hard-coded with the classifications, and the similar questions I have seen on this site uses xacml 3.0 and alfa. I have not been able to code the category part. This is my condition in the policy for hard-coded attributes.
<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
<SubjectAttributeDesignator
AttributeId="classification"
DataType="http://www.w3.org/2001/XMLSchema#string"/>
</Apply>
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">top-secret</AttributeValue>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
<ResourceAttributeDesignator
AttributeId="resclassification"
DataType="http://www.w3.org/2001/XMLSchema#string"/>
</Apply>
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">top-secret</AttributeValue>
</Apply>
</Condition>
Any help?
This code works with hard-coded attributes.
<!-- Hard-coded condition check -->
<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-greater-than-or-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
<SubjectAttributeDesignator
AttributeId="classification"
DataType="http://www.w3.org/2001/XMLSchema#string"/>
</Apply>
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">3.0 top-secret</AttributeValue>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
<ResourceAttributeDesignator
AttributeId="resclassification"
DataType="http://www.w3.org/2001/XMLSchema#string"/>
</Apply>
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">3.0 top-secret</AttributeValue>
</Apply>
</Condition>

Answer 1

To solve the problem you have to define attributes as follows:
SubjectClassificationRank (Data Type: integer),
SubjectAccessCategory (Data Type: string),
ResourceClassificationRank (Data Type: integer),
ResourceCategory (Data Type: string)
The XACML 2.0 code for your whole condition is as follows:
<Condition>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-greater-than-or-equal">
<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subjectcategory:accesssubject" AttributeId="SubjectClassificationRank" DataType="http://www.w3.org/2001/XMLSchema#integer" MustBePresent="false"></SubjectAttributeDesignator>
<ResourceAttributeDesignator AttributeId="ResourceClassificationRank" DataType="http://www.w3.org/2001/XMLSchema#integer" MustBePresent="false"></ResourceAttributeDesignator>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:all-of-any">
<Function FunctionId="urn:oasis:names:tc:xacml:2.0:function:integer-greater-than"></Function>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
<ResourceAttributeDesignator AttributeId="ResourceCategory" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></ResourceAttributeDesignator>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subjectcategory:accesssubject" AttributeId="SubjectAccessCategory" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></SubjectAttributeDesignator>
</Apply>
</Apply>
</Apply>
</Condition>
Explanation :
first it applies a greater than function between Subject's Rank and Resource's rank and get the boolean "result-1".part of this as follows:
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-greater-than-or-equal">
<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subjectcategory:accesssubject" AttributeId="SubjectClassificationRank" DataType="http://www.w3.org/2001/XMLSchema#integer" MustBePresent="false"></SubjectAttributeDesignator>
<ResourceAttributeDesignator AttributeId="ResourceClassificationRank" DataType="http://www.w3.org/2001/XMLSchema#integer" MustBePresent="false"></ResourceAttributeDesignator>
</Apply>
Separately it makes one bag out of SubjectAccessCategory list and other bag out of ResourceCategory list.Then compare to return true if the each element first bag(ResourceCategory List) contains in second bag(SubjcetAccessCategory) else false which is "result2".
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:all-of-any">
<Function FunctionId="urn:oasis:names:tc:xacml:2.0:function:integer-greater-than"></Function>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
<ResourceAttributeDesignator AttributeId="ResourceCategory" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></ResourceAttributeDesignator>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subjectcategory:accesssubject" AttributeId="SubjectAccessCategory" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></SubjectAttributeDesignator>
</Apply>
</Apply>
Then finally combines both "result1" and "result2" with "And" function.