search

oasis-tcs / xacml-spec

OASIS XACML TC: List for tracking issues and features for the OASIS XACML TC. https://github.com/oasis-tcs/xacml-spec
Other
4 stars 0 forks source link

Add some mechanism to use XACML Variables in XPath expressions #30

Open cdanger opened 2 months ago

cdanger commented 2 months ago

This would allow to use XACML variables as inputs to any XPath function / expression, which would provider simpler alternatives to certain complex ApplyExpressions.

For example, say we declare a variable classif_name:

<VariableDefinition VariableId="classif_name>...</VariableDefinition>

Then we want to use it in a XPath expression as follows:

<AttributeSelector Path="if ($classif_name = 'SECRET') then 3 else if ($classif_name = 'CONFIDENTIAL') then 2 else if ($classif_name = 'RESTRICTED ') then 1 else 0" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#integer" MustBePresent="true" />

The idea is to use the same variable ID in the XPath expression as the VariableDefinition.

steven-legg commented 2 months ago

Can we simply say that all the variables in scope of the attribute selector with names that are valid for XPath variable names, and have a compatible data-type, are available to reference in the XPath expression?

cdanger commented 2 months ago

Yeah, we can say that.