XACML compare two request attributes. - xacml3

Question

My xacml request contains two attributes which I want to compare as part of a policy's condition.
They are:
urn:oasis:names:tc:xacml:1.0:subject:group-id
urn:oasis:names:tc:xacml:1.0:resource:resource-id
All the policy examples I've found compare only one request attribute (i.e. ResourceAttributeDesignator) with an AttributeValue which is hard coded.
How do I compare that group-id equals resource-id?

Answer 1

You need to use a XACML Condition. Policy Sets, Policies, and Rules all have XACML Targets which you can use to compare an attribute to a value e.g. role=='manager'. Rules also have the XACML Condition element with which you can do more advanced comparisons including comparing two attributes.
Here is an example (using the ALFA notation):
namespace stackoverflow{
attribute groupId{
category = subjectCat
id = "urn:oasis:names:tc:xacml:1.0:subject:group-id"
type = string
}
attribute resourceId{
category = resourceCat
id = "urn:oasis:names:tc:xacml:1.0:resource:resource-id"
type = string
}
policy example{
apply firstApplicable
rule checkGroup{
condition groupId==resourceId
permit
}
}
}
Here is the output in XACML 3.0:
<?xml version="1.0" encoding="UTF-8"?>
<!--This file was generated by the ALFA Plugin for Eclipse from Axiomatics AB (http://www.axiomatics.com).
Any modification to this file will be lost upon recompilation of the source ALFA file-->
<xacml3:Policy xmlns:xacml3="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
PolicyId="http://axiomatics.com/alfa/identifier/stackoverflow.example"
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"
Version="1.0">
<xacml3:Description />
<xacml3:PolicyDefaults>
<xacml3:XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</xacml3:XPathVersion>
</xacml3:PolicyDefaults>
<xacml3:Target />
<xacml3:Rule
Effect="Permit"
RuleId="http://axiomatics.com/alfa/identifier/stackoverflow.example.checkGroup">
<xacml3:Description />
<xacml3:Target />
<xacml3:Condition>
<xacml3:Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of-any">
<xacml3:Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
<xacml3:AttributeDesignator
AttributeId="urn:oasis:names:tc:xacml:1.0:subject:group-id"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
MustBePresent="false"
/>
<xacml3:AttributeDesignator
AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
MustBePresent="false"
/>
</xacml3:Apply>
</xacml3:Condition>
</xacml3:Rule>
</xacml3:Policy>
You can download the ALFA plugin here.