XACML policies - Using regex for attribute values inside conditions - authorization

Question

I want to use regex for the attribute values to match the resource names. For example, http://localhost.*/private/team, so that the following values matches
http://localhost:8080/private/team,
http://localhost:8080/abcd/private/team
I have the following policy
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="InStorePolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
<Target>
<AnyOf>
<AllOf>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">access</AttributeValue>
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
</Match>
</AllOf>
</AnyOf>
</Target>
<Rule Effect="Permit" RuleId="Rule_for_employee">
<Target>
<AnyOf>
<AllOf>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">employee</AttributeValue>
<AttributeDesignator AttributeId="http://wso2.org/claims/role" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
</Match>
</AllOf>
<AllOf>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">manager</AttributeValue>
<AttributeDesignator AttributeId="http://wso2.org/claims/role" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
</Match>
</AllOf>
</AnyOf>
</Target>
<Condition>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">private/support</AttributeValue>
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">private/team</AttributeValue>
</Apply>
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
</Apply>
</Condition>
</Rule>
<Rule Effect="Permit" RuleId="Rule_for_manager">
<Target>
<AnyOf>
<AllOf>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">manager</AttributeValue>
<AttributeDesignator AttributeId="http://wso2.org/claims/role" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
</Match>
</AllOf>
</AnyOf>
</Target>
<Condition>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">private</AttributeValue>
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">private/business</AttributeValue>
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">private/leadership</AttributeValue>
</Apply>
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
</Apply>
</Condition>
</Rule>
<Rule Effect="Deny" RuleId="Rule_deny_all"/>
</Policy>
The resources are within the condition tag. I tried and couldn't add the string-regex function inside the condition. is it possible for me to add regex functions inside string-bag ? Or do I have to move it to target ? How can I achieve this ?
Regards,
Albie Morken

Answer 1

In your example, you could simply use one of the following XACML functions:
stringContains (urn:oasis:names:tc:xacml:3.0:function:string-contains)
stringEndsWith (urn:oasis:names:tc:xacml:3.0:function:string-ends-with)
Edit
These two functions work on atomic values e.g. "a", or "b". By default, attributes in XACML are bags. This means that role is a bag of values (could be 0, 1, or more values - a bag nonetheless). This means that if you want to use stringContains() on a bag, you need to either use stringOneAndOnly first to convert the bag into a single value or you need to use a higher-order function.
stringOneAndOnly
Try the following for instance (using ALFA notation)
// The result SHALL be true if the second string contains the first string, and false otherwise.
stringContains("manager", stringOneAndOnly(role))
Higher-order functions
Alternatively you can use AnyOf or AnyOfAny applied to stringContains().