Comments (3)
cdanger
commented on June 14, 2024
1
Yes, indeed, we don't support the "Default Category objects" (section 4 of the JSON profile). Sorry I missed that the first time. So you have to rewrite your Request using the generic form with "Category" objects like:
{
"Request": {
"ReturnPolicyIdList": true,
"Category": [
{"CategoryId": "urn:oasis:names:tc:xacml:1.0:subject-category:access-subject",
"Attribute": [
{"AttributeId": "user-type", "Value": "Practitioner"},
{"AttributeId": "practitioner-role", "Value": "administrator"}
]
},
{"CategoryId": "urn:oasis:names:tc:xacml:3.0:attribute-category:resource",
"Attribute": [
{"AttributeId": "resource-type", "Value": "Practitioner"},
{"AttributeId": "resource-id", "Value": "123"}
]
},
{"CategoryId": "urn:oasis:names:tc:xacml:3.0:attribute-category:action",
"Attribute": [
{"AttributeId": "interaction", "Value": "instance.read"}
]
}
]
}
}
from fiware.
cdanger
commented on June 14, 2024
It's probably disabled by default. In order to enable it, you need to set the config property org.ow2.authzforce.domains.enableXacmlJsonProfile to true in file /usr/local/tomcat/conf/Catalina/localhost/authzforce-ce.xml.
With docker, the best option is probably to mount your own modified copy of that file on your host (you can get it from the running container with docker cp command) as a volume, e.g.:
$ docker run -v ./my-authzforce-ce.xml:/usr/local/tomcat/conf/Catalina/localhost/authzforce-ce.xml ......
from fiware.
7opf
commented on June 14, 2024
@cdanger thanks - You're right it was disabled. Unfortunately I'm not able to get the expected behaviour. I no longer get a 501 response, instead I get 200 with the following repsonse:
{
"Status": {
"StatusCode": {
"Value": "urn:oasis:names:tc:xacml:1.0:status:syntax-error"
},
"StatusMessage": "Invalid Request"
},
"Decision": "Indeterminate"
}
I get the same response with this example request: https://docs.oasis-open.org/xacml/xacml-json-http/v1.0/cos01/xacml-json-http-v1.0-cos01.html#_Toc497727120
Performing the first PDP request, but as the below xacml+xml resulted in expected (Permit) result.
<?xml version="1.0" encoding="UTF-8"?>
<xacml-ctx:Request ReturnPolicyIdList="true" CombinedDecision="false" xmlns:xacml-ctx="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" >
<xacml-ctx:Attribute AttributeId="user-type" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Practitioner</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
<xacml-ctx:Attribute AttributeId="practitioner-role" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">monitor</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
</xacml-ctx:Attributes>
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" >
<xacml-ctx:Attribute AttributeId="interaction" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">instance.read</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
</xacml-ctx:Attributes>
<xacml-ctx:Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" >
<xacml-ctx:Attribute AttributeId="resource-type" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Practitioner</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
<xacml-ctx:Attribute AttributeId="resource-id" IncludeInResult="true">
<xacml-ctx:AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">123</xacml-ctx:AttributeValue>
</xacml-ctx:Attribute>
</xacml-ctx:Attributes>
</xacml-ctx:Request>
the only policies on the server is the default root policy set
from fiware.
Related Issues (19)
- Update domains path in Dockerfile.
- Documentation typos: missing XACML namespace in sample request
- Problem with the configuration of Maven POM: HOT 4
- Authzforce should expose Docker Volumes
- [SHOULD] Double tag FIWARE Release HOT 1
- [MUST] Credits are missing
- Doc - Features section - typos
- Unable to use docker container HOT 9
- Automate building of the docker image at Docker Hub. HOT 1
- Authzforce GE docker image is vulnerable HOT 2
- Unable to use JWT token generated from Fiware Keyrock HOT 5
- Provide versioned tags for the docker images. HOT 2
- Confusing example of a GET request in Users and Programmers Guide
- XML returned by Policy Decision API differs from documentation.
- Docker image release-5.4.0 fails to start HOT 3
- Problem in interaction between idm,pep and authzforce HOT 6
- Unable to perform Level 2: Basic Authorization HOT 16
- Add features section to documentation (readthedocs.org)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fiware.