← Prev in month ← Prev in thread

Problem with an or function

From
<>
Date
2011-01-27T16:32:30+00:00
ID
Thread
Problem with an or function
Hello

I want to express a quite simple rule :

profile1>10 or profile2>10

Here is the corresponding XACML :

<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">

  <Apply FunctionId="urn:bxss:xacml:string-greater-than-or-equals">

    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">

      <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:SAML:2.0:attrname-format:basic:profile1" DataType="http://www.w3.org/2001/XMLSchema#string"></SubjectAttributeDesignator>

    </Apply>

    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">10</AttributeValue>

  </Apply>

  <Apply FunctionId="urn:bxss:xacml:string-greater-than-or-equals">

    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">

      <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:SAML:2.0:attrname-format:basic:profile2" DataType="http://www.w3.org/2001/XMLSchema#string"></SubjectAttributeDesignator>

    </Apply>

    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">10</AttributeValue>

  </Apply>

</Condition>

If I come with profile1=20 : the result is PERMIT

If I come with profile2=20 : the result is DENY !!!!!

I think that the following happened :

If I have profile2=20 and no profile1 at all, the function first try to evaluate the profile1 and string-one-and-only  fails because profile1 does not exists. Then the evaluation cannot be done, the whole process fails and we don't even try to evaluate the second possibility with profile2.....

Am I right ?

What could be the solution to handle such a problem ?

Valerie
← Prev in month ← Prev in thread