Search code examples
authorizationrbacxacmlabacalfa

Can an attribute be used for several categories in ALFA?


A doctor can belong to subjectCat (the user that is trying to gain access) or to resourceCat (the referring physician of a medical examination the subject is trying to access).

As it appears to me, to support both cases I need to define the doctor for each category individually:

namespace subject {
     namespace doctor {
          attribute id {
                    category = subjectCat
                    id = "id"
                    type = string
          }
          attribute lastname {
                    category = subjectCat
                    id = "lastname"
                    type = string
          }
          //and 20 more attributes...
      }
}


namespace resource {
     namespace doctor {
          attribute id {
                    category = resourceCat //this line is the only difference
                    id = "id"
                    type = string
          }
          attribute lastname {
                    category = resourceCat //this line is the only difference
                    id = "lastname"
                    type = string
          }
          //and 20 more attributes...
      }
}

That's pretty cumbersome and bears a lot of redundancy. Is there anything I can do to avoid that?


Solution

  • You are right. You would redefine the attributes. In a way you are using the same object from your information model (e.g. doctor) but in one case that object (Doctor) acts as a subject. In another, it acts as an object you are protecting e.g.

    • A doctor can view a medical record of a patient they are assigned to.
    • An HR staff can view the salary of a doctor.

    Yes, it means you would have to define the attribute itself in multiple categories. You can still leverage the namespace structure insofar as the combination of namespace and name remains unique.

    You could do acme.user.staff.doctor and attribute name. You could then do acme.object.doctor and attribute name.

    Note that Eclipse will let you do autocomplete too:

    Auto-completing attribute names in ALFA inside Eclipse