WSO2 Identity - XACML Simple Editor - Try It with Time Range - Error

Following the instructions for Simple Editor, I'm experiencing difficulties to use the environment time range parameter under WSO2 Version 5. The test displays an error:

<StatusMessage>Invalid request  : DOM of request element can not be created from String</StatusMessage>

The definition was added with the syntax: [06:00:00+05:00, 19:00:00+05:00]

Below you find the resulting XACML code generated by the Simple Editor:

Policy

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="TodaysPolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Description>Doctor</Description>
   <Target>
      <AnyOf>
         <AllOf>
            <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">^(http:)</AttributeValue>
               <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            </Match>
         </AllOf>
      </AnyOf>
   </Target>
   <Rule Effect="Permit" RuleId="Rule-1">
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">delete</AttributeValue>
                  </Apply>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
               </Apply>
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-greater-than-or-equal">
                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#time" MustBePresent="true"/>
                     </Apply>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">06:00:00 05:00</AttributeValue>
                  </Apply>
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-less-than-or-equal">
                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#time" MustBePresent="true"/>
                     </Apply>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">19:00:00 05:00</AttributeValue>
                  </Apply>
               </Apply>
            </Apply>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">doctor</AttributeValue>
               </Apply>
               <AttributeDesignator AttributeId="http://wso2.org/claims/role" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="Deny-Rule"/>
</Policy>

Request (with adjusted ID fields for claims/role and current-time):

<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false">
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action">
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="false">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue>
</Attribute>
</Attributes>
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
<Attribute AttributeId="http://wso2.org/claims/role" IncludeInResult="false">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">doctor</AttributeValue>
</Attribute>
</Attributes>
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" IncludeInResult="false">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">08:00:00+05:00</AttributeValue>
</Attribute>
</Attributes>
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="false">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:9444/medicalrecords</AttributeValue>
</Attribute>
</Attributes>
</Request>

Thanks in advance for your support. Regards, Claude

Solution

Below a syntax that supports time window based authorization:

Policy built by simple editor in XACML format

resource input was: {^(http:)}

role input was: doctor | admin

action input was: read | write | delete

time field input was: [06:00:00+05:00,20:00:00+05:00]

Result: Permit

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="TodaysPolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Description>Rules with time</Description>
   <Target>
      <AnyOf>
         <AllOf>
            <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">^(http:)</AttributeValue>
               <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            </Match>
         </AllOf>
      </AnyOf>
   </Target>
   <Rule Effect="Permit" RuleId="Rule-1">
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">delete</AttributeValue>
                  </Apply>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
               </Apply>
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-greater-than-or-equal">
                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#time" MustBePresent="true"/>
                     </Apply>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">06:00:00 05:00</AttributeValue>
                  </Apply>
                  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-less-than-or-equal">
                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#time" MustBePresent="true"/>
                     </Apply>
                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">20:00:00 05:00</AttributeValue>
                  </Apply>
               </Apply>
            </Apply>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
               <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">doctor</AttributeValue>
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
               </Apply>
               <AttributeDesignator AttributeId="http://wso2.org/claims/role" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="Deny-Rule"/>
</Policy>

Request – Includes Current Time

    <Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false"> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"> 
<Attribute AttributeId="http://wso2.org/claims/role" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"> 
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" IncludeInResult="false"> 
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:9444/medicalrecords</AttributeValue> 
</Attribute> 
</Attributes> 
<Attributes Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment">
<Attribute IncludeInResult="false" AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" >
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">08:00:00+05:00</AttributeValue> 
</Attribute> 
</Attributes> 
</Request>

Hope this sample helps to clarify the structure of the request.