[xacml] Boolean Policy resolution

[Anne Anderson <Anne.Anderson@Sun.com>]

Colleagues,

Attached is the write-up of the Boolean Policy proposal (plain
text) that I presented at the Face-to-Face.  This version
includes all the comments and modifications made during the
review and discussion.  Open issues that were not agreed on are
in [...].

This was discussed prior to Simon's alternative proposal, so does
not include additional modifications that may be required by
that.

Anne
-- 
Anne H. Anderson             Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692

Predicate: an expression that evaluates to TRUE, FALSE,
    NOT-APPLICABLE, or ERROR.  Relational expresssions,
    Combinator expressions, <xacml:policy> elements,
    <xacml:applicablePolicyReference> elements, and
    <xacml:applicablePolicy> elements are all Predicates.

Relational expression: a Relational expression is a Predicate
    that compares a value relevant to the Access Request with
    another value relevant to the Access Request or with a
    literal value.

    A Relational expression never evaluates to NOT-APPLICABLE.

    A Relational expression evaluates to ERROR if the expression
    can not be evaluated for any reason, such as inability to
    access a value in the predicate.

Combinator: an operator that can be used to combine
    Predicates.

Combinator expression:   A Combinator expression is the operator and the
    Predicates to which it applies.  A Combinator expression is
    itself a Predicate.

    A Combinator expression evaluates to ERROR if any of the
    Predicates to which it applies and which are evaluated as
    part of producing a result evaluates to ERROR.

    A Combinator expression evaluates to NOT-APPLICABLE if all of
    its component Predicates evaluate to NOT-APPLICABLE.

    A Combinator expression in which some, but not all of the
    Predicates to which it applies evaluates to NOT-APPLICABLE is
    evaluated as if the NOT-APPLICABLE Predicates were removed
    from the Combinator expression.

    An empty Combinator expression evaluates to [NOT-APPLICABLE].

    The xacml-defined Combinators are AND, OR, NOT, N-OF,
    ORDERED-AND, ORDERED-OR, and ORDERED-N-OF.  AND, OR, NOT, and
    N-OF Combinators are implemented such that the order of
    evaluation is not specified, and such that only a sufficient
    set of predicates to determine a result are evaluated.
    ORDERED-* Combinators require that the Predicates to which
    they apply be evaluated in order until a result is obtained.
    N-OF(*) means "at least N of" the Predicates to which it
    applies must be TRUE.

       E.g. <N-OF n=3>
               P1
               P2
               P3
               P4
            </N-OF>

    It is an error for an <N-OF> Combinator expression to have an
    n= attribute value that is greater than the number of
    predicates to which the combinator applies.  n=1 is
    equivalent to OR.  [n=0 is ...].

    The set of Combinators may be extended by [specifying a name
    for the new Combinator, a URI that is associated with the
    semantics of the new Combinator, and a type that specifies
    the way the URI is to be interpreted.  Not all XACML PDPs
    will be able to interpret all extensions, but any PDP that
    can handle the specified type and can access the specified
    URI can handle the specified extended Combinator.]

    An example of a possible extended Combinator is
    BEST-MATCH-OR. [The type for such an extended Combinator
    might be "JavaClass".  The URI for each might point to a Java
    class that takes a set of Predicates as input and implements
    the semantics of the combinator to return a result of TRUE,
    FALSE, NOT-APPLICABLE, or ERROR.]

Policy: an <xacml:policy> element.  A Policy is a Predicate.

Base Policy: the <xacml:applicablePolicy> element that specifies
    the <xacml:policy> element that a PDP will use [by default]
    to evaluate all Access Requests.

    [Alternative 1:
    A PDP MAY have multiple Base Policies, but such Base Policies
    SHOULD have non-overlapping <xacml:target> elements.  This
    specification does not specify the order in which multiple
    Base Policies are evaluated, or the result if two or more
    Base Policies have overlapping <xacml:target> elements.

    Alternative 2:
    Base Policies have restricted <target> elements that are
    easily compared for overlap.  In this alternative, the case
    where base policies overlap is an ERROR.  Note that the 0.8
    syntax favors this alternative and allows Alternative 3.

    Alternative 3:
    There is only one Base Policy and it has no <target> because
    applies to all Resource or it has a <target> element that
    completely specifies the set of resources which this PDP is
    prepared to handle.]

    [A Base Policy for evaluating a particular Access Request may
    be specified as part of the Access Request.  If a PDP has no
    default Base Policy, then the result of evaluating an Access
    Request that does not specify a Base Policy to use is FALSE
    (deny access).]

<applicablePolicyReference>: an XACML Predicate element that
    references an <xacml:applicablePolicy>.  [Redundant: A
    <xacml:applicablePolicyReference> Predicate returns a value
    of NOT-APPLICABLE if its <xacml:target> element does not
    match the [<saml:resource>] in the Access Request.]  [The
    syntax for a <applicablePolicyReference> will need to be
    defined further, probably by specifying the Policy Authority
    for the <applicablePolicyReference> along with other
    information.  Need to avoid cycles.]

Aggregate Policy: the collection of policies consisting of a Base
    Policy along with the closure of the tree of any
    <xacml:applicablePolicyReference> elements to which the Base
    Policy may refer.  If a Base Policy does not refer to any
    <xacml:applicablePolicyReference> elements, then the
    Aggregate Policy is equivalent to the Base Policy.

Example 1: a self-contained Aggregate Policy

<?xml version="1.0" encoding="UTF-8"?>
<applicablePolicy
        xmlns=... 
        issuer="<identity that ultimately controls policy for this PDP>"
        policyName="xxxx">
    <!-- target is optional -->
    <policy>
        <or>
            <equal>
                <valueRef>saml:Subject/principalIdentifier/Name</valueRef>
                <value>"Anne Anderson"</value>
            </equal>
            <equal>
                <valueRef>saml:Subject/principalIdentifier/Name</valueRef>
                <value>"Sekhar Vajjhala"</value>
            </equal>
        </or>
    </policy>
</applicablePolicy>

Example 2: an Aggregate Policy containing a
    <applicablePolicyReference> Predicate

<?xml version="1.0" encoding="UTF-8"?>
<applicablePolicy
        xmlns=... 
        issuer="<identity that ultimately controls policy for this PDP>"
        policyName="xxxx">
    <!-- target is optional -->
    <policy>
        <or>
            <equal>
                <valueRef>saml:Subject/principalIdentifier/Name</valueRef>
                <value>"Anne Anderson"</value>
            </equal>
            <applicablePolicyReference>
                http://www.sun.com/CorporatePolicy
            </applicablePolicyReference>
        </or>
    </policy>
</applicablePolicy>

The Sub-Policy obtained by doing a GET on
http://www.sun.com/CorporatePolicy is:

<applicablePolicy
        xmlns=... 
        issuer="<identity that defines Sun Corporate Policy>"
        policyName="xxxx">
    <target resourceClassification="*.sun.com/*"
            resourceToClassificationTransform="regularExpressionURI"/>
    <policy>
        <equal>
            <valueRef>saml:Subject/principalIdentifier/Name</valueRef>
            <value>"Sekhar Vajjhala"</value>
        </equal>
    </policy>
</applicablePolicy>

If the <Resource> in the Access Request matches "*.sun.com/*",
    then this <xacml:applicablePolicyReference> will return TRUE,
    FALSE, or ERROR.

If the saml:authorizationQuery Resource does not match
    "*.sun.com/*", then this sub-policy will return
    NOT-APPLICABLE.  In this case, the Aggregate Policy is
    equivalent to the single remaining predicate.  A
    <xacml:policy> element evaluates to NOT-APPLICABLE it its
    outermost Predicate evaluates to NOT-APPLICABLE.