Description:
I have an obligation which generates an attribute missing but MustBePresent set to true. The policy generates an effect of "Permit" according to the rule. I believe that this is incorrect behavior and it should result in Indeterminate possibly with a Status about the missing attribute.
Suggested Assignees:
With hints about how to go about this I would be willing to try and fix.
Affected Product Version:
Current Development tree
OS, DB, other environment details and versions:
Windows 10
Steps to reproduce:
Rule in question is:
<Rule RuleId="ResourceDirectory_4" Effect="Permit">
<Description>
Scope with no endpoint given - Get EP name from attributes
</Description>
<Target>
<AnyOf>
<AllOf>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">/rd</AttributeValue>
<AttributeDesignator AttributeId="http://augustcellars.com/ace/scopeName" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
</Match>
</AllOf>
</AnyOf>
</Target>
<ObligationExpressions>
<ObligationExpression ObligationId="NewScope" FulfillOn="Permit">
<AttributeAssignmentExpression AttributeId="http://augustcellars.com/ace/scopeName" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
<Apply FunctionId="urn:oasis:names:tc:xacml:2.0:function:string-concatenate">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">/rd?ep=</AttributeValue>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
<AttributeDesignator AttributeId="http://augustcellars.com/ace/endpoint" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
</Apply>
</Apply>
</AttributeAssignmentExpression>
</ObligationExpression>
</ObligationExpressions>
</Rule>
Description: I have an obligation which generates an attribute missing but MustBePresent set to true. The policy generates an effect of "Permit" according to the rule. I believe that this is incorrect behavior and it should result in Indeterminate possibly with a Status about the missing attribute.
Suggested Assignees: With hints about how to go about this I would be willing to try and fix.
Affected Product Version: Current Development tree
OS, DB, other environment details and versions:
Windows 10
Steps to reproduce: Rule in question is:
Request
Reponse is
Related Issues: I am not aware of any