XACML - How to express "not male" rather than "not gender == male" [duplicate] - xacml

Question

This question already has an answer here:
Using XACML to express policy which is a logical expression
(1 answer)
Closed 4 years ago.
The function not in XACML asks for a boolean argument. However, I want to express a policy like "not string" such as "not male". I can't use "not gender == male" to instead that. I searched google and stackoverflow, but I failed to solve this problem. How could I do that?

Answer 1

When you send a XACML request, you always send a set of attributes with one or more values. You would either send:
an attribute with identifier gender, datatype string, and category subject, or
an attribute with identifier male, datatype boolean, and category subject.
Either way you still send an attribute. In one case the value is a string. In the other the value is a string. In the explanation below, I take the string approach. If you want the boolean approach, just replace gender=="male" with male.
Note that in XACML, attributes may possibly not have a value. This makes XACML booleans more than just boolean. Male could be true, false, or undefined. Keep that in mind when you write a policy / rule.
To express negative conditions e.g. not(gender==male), you have two options:
either the set of possible values is finite e.g. true/false, male/female, hot/warm/cold and you are happy building a policy or rule per case.
or the set of possible values is too long or infinite e.g. a numerical value or a list of citizenships (180+ of those).
In the former case you can write the following (pseudo-code in ALFA):
policy checkGender{
apply firstApplicable
rule male{
target clause gender=="male"
permit
}
rule female{
target clause gender=="female"
permit
}
/**
* Optionally add a catch all case
*/
rule other{
target clause ... // Here you'd have to define other checks you are interested in
}
}
In the latter case, you need to write a negative condition. To do that you need to use a XACML condition. Since XACML conditions only live inside rules, you need to go down to the XACML Rule level.
policy checkGender{
apply firstApplicable
rule notMale{
condition not(gender=="male")
permit
}
}