I Simon,thank you for the remark. It's effectively simpler. I have already tested many sort of method to test (urn:oasis:names:tc:xacml:1.0:function:string-equal, urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of, urn:oasis:names:tc:xacml:1.0:function:string-bag, urn:oasis:names:tc:xacml:1.0:function:regexp-string-match, ...) the user (urn:fedora:names:fedora:2.1:subject:loginId) or his group (fedoraRole), but each time the rule doesn't have the attempted effect. When I put the DEBUG level for the logs, I interpret the informations as if FedoraCommons couldn't get the role or the name of the user when the rule concern a single object. I can't imagine it's a bug of FC because the rule is very basical... but I really don't know where to search to solve my problem. I have limited the XACML file to the minimum to be sure that the rule isn't disturb by another one.
I have get the sources of FC (RC1) and recompile thefcrepo-server adding more tracks... but the informations seems to be in the XACML libraries, not included in FC.
Have you other advices or remarks?... Greetings Pierre-Yves Simon McMillan a écrit :
Hi Pierre-Yves, Your RuleID="1" could be simpler, I think. Have you tried something like this? <Rule RuleId="1" Effect="Deny"> <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:not"> <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in"><AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string";>Group1</AttributeValue> <SubjectAttributeDesignator AttributeId="fedoraRole" DataType="http://www.w3.org/2001/XMLSchema#string"/> </Apply> </Condition></Rule> Regards, Simon. -----Original Message-----From: Pierre-Yves JALLUD [mailto:[email protected]] Sent: Wednesday, 28 July 2010 12:51 AMTo: fedora-commons-developers Subject: [Fedora-commons-developers] XACML - restrict the access Hi all, as I didn't have a reponse, I permit me to send again my question in the developper list. I have made many tests from the examples of https://wiki.duraspace.org/display/FCR30/XACML+Vocabulary+and+Examples But I don't success to permit the access of an specific object to a single user. Have you any recommandations?... It's very important for my project and really don't understand why it doesn't work. Greetings Pierre-YvesDate: Fri, 23 Jul 2010 12:59:56 +0200 From: Pierre-Yves JALLUD <[email protected]> Subject: [Fedora-commons-users] XACML - restrict the access To: fedora-commons-users <[email protected]> Message-ID: <[email protected]> Content-Type: text/plain; charset="iso-8859-1" Hi all, I'm trying to make a policy role to deny the access to an object(MyNS:Restricted_Object) if the user hasn't the Group1 role (defined in the fedora-users.xml). You can find below the definition of the user and the XACML file. But it doesn't work! When I don't activate the XACML file, there is no restriction to access to the object and its datastreams. But when I activate it, the access is denied to any user. I'm using the version 3.2.1 of Fedora Commons, installed in a LINUX server (Linux myFCComputer 2.6.18-164.el5 #1 SMP Tue Aug 18 15:51:48 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux).Doese anyone knows why it doesn't work as I want? Greetings Pierre-Yves error returned by the web admin:Could not retrieve object '' from the repository. Either the object does not exist, or you do not have permission to view it.error returned by the access to the url of the object: 403 Forbidden Authorization failed fedora-users.xml: ... <user name="User1" password="XXXXX"> <attribute name="fedoraRole"> <value>Group1</value> </attribute> </user> ... deny-access-object-list-if-not-group1.xml:<?xml version="1.0" encoding="UTF-8"?> <Policy xmlns="urn:oasis:names:tc:xacml:1.0:policy"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; PolicyId="deny-access-object-list-if-not-group1"RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"> <Description> </Description> <Target> <Subjects> <AnySubject/> </Subjects> <Resources> <Resource> <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string";>MyNS:Restricted_Object</AttributeValue> <ResourceAttributeDesignator AttributeId="urn:fedora:names:fedora:2.1:resource:object:pid" DataType="http://www.w3.org/2001/XMLSchema#string"/> </ResourceMatch> </Resource> </Resources> <Actions> <AnyAction/> </Actions> </Target> <Rule RuleId="1" Effect="Deny"> <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:not"> <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of"> <SubjectAttributeDesignator AttributeId="fedoraRole" MustBePresent="false" DataType="http://www.w3.org/2001/XMLSchema#string"/> <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag"> <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string";>Group1</AttributeValue> </Apply> </Apply> </Condition> </Rule> </Policy>
<<attachment: pierre-yves_jallud.vcf>>
------------------------------------------------------------------------------ The Palm PDK Hot Apps Program offers developers who use the Plug-In Development Kit to bring their C/C++ apps to Palm for a share of $1 Million in cash or HP Products. Visit us here for more details: http://ad.doubleclick.net/clk;226879339;13503038;l? http://clk.atdmt.com/CRS/go/247765532/direct/01/
_______________________________________________ Fedora-commons-developers mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fedora-commons-developers
