Search code examples
authorizationaccess-controlxacmlabacalfa

Wrong XACML function identifier in output of Eclipse ALFA plugin

The XACML output for any-of-any seems to be wrong:

FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of-any"

is what I get and

FunctionId="urn:oasis:names:tc:xacml:3.0:function:any-of-any"

is what AutzZForce-core wants.

I already uncommented this line in system.alfa, but there is still the same issue.

function anyOfAny = "urn:oasis:names:tc:xacml:3.0:function:any-of-any" : function anyAtomicOrBag anyAtomicOrBag* -> boolean
Solution

  • A couple of different things.

    1. First of all, urn:oasis:names:tc:xacml:1.0:function:any-of-any is a valid XACML identifier. It is normative and mandatory in XACML 3.0. It is planned for deprecation in future versions but for now, it is still part of the standard. See the XACML spec for details.
    2. As you point out the new, preferred identifier is urn:oasis:names:tc:xacml:3.0:function:any-of-any. Given the way ALFA is built, you can change the identifier yourself in system.alfa. To do so, open the file and locate the value you do not care for (in this case urn:oasis:names:tc:xacml:1.0:function:any-of-any) and replace it with the newer identifier.

    Original

    function anyOfAny = "urn:oasis:names:tc:xacml:1.0:function:any-of-any" : function anyAtomicOrBag anyAtomicOrBag* -> boolean

    New

    function anyOfAny = "urn:oasis:names:tc:xacml:3.0:function:any-of-any" : function anyAtomicOrBag anyAtomicOrBag* -> boolean