查看“CBAC”的源代码


<meta charset="utf-8" />
<meta property="mw:pageId" content="75" />
<meta property="mw:pageNamespace" content="0" />

<meta property="mw:revisionSHA1" content="ecb6fc1a18535197780f8c3448dcf9329df00611" />
<meta property="dc:modified" content="2026-08-30T19:12:37.000Z" />
<meta property="mw:html:version" content="2.1.0" />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]-->
<meta http-equiv="content-language" content="zh-cn" />
<meta http-equiv="vary" content="Accept" />



=例1：基础policy，OASIS 规范正式例子的起点=
来源：https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047096

语法：单条 Policy + 单条 Rule，Policy 级 Target 为空，Rule 级 Target 用 rfc822Name-match 对请求里的 subject-id 做邮箱域匹配；没有 Condition、Obligation、PolicySet。相比 WSO2 的 string-equal/集合比较，这里第一次出现“带类型的函数语义”（RFC822 邮箱域名匹配）
==原文：==
<syntaxhighlight lang="xml">
<?xml version="1.0" encoding="UTF-8"?>
<Policy
  xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17
  http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd"
  PolicyId="urn:oasis:names:tc:xacml:3.0:example:SimplePolicy1"
  Version="1.0"
  RuleCombiningAlgId="identifier:rule-combining-algorithm:deny-overrides">
  <Description>
    Medi Corp access control policy
  </Description>
  <Target/>
  <Rule
    RuleId="urn:oasis:names:tc:xacml:3.0:example:SimpleRule1"
    Effect="Permit">
    <Description>
      Any subject with an e-mail name in the med.example.com domain
      can perform any action on any resource.
    </Description>
    <Target>
      <AnyOf>
        <AllOf>
          <Match
            MatchId="urn:oasis:names:tc:xacml:1.0:function:rfc822Name-match">
            <AttributeValue
              DataType="http://www.w3.org/2001/XMLSchema#string"
              >med.example.com</AttributeValue>
            <AttributeDesignator
              MustBePresent="false"
              Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
              AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
              DataType="urn:oasis:names:tc:xacml:1.0:data-type:rfc822Name"/>
          </Match>
        </AllOf>
      </AnyOf>
    </Target>
  </Rule>
</Policy>
</syntaxhighlight>
==逻辑结构：==
Policy SimplePolicy1 (deny-overrides) ├── Target = 空（适用于所有请求） └── Rule SimpleRule1 (Permit)
    ├── 描述：med.example.com 域内的邮箱主体可以对任意资源执行任意动作
    └── Target: subject-id (rfc822Name) 匹配 "med.example.com"
==属性表：==
（ AttributeId    |    Category    |   DataType    |   MustBePresent    |   含义    ）

| `subject-id` | access-subject | `rfc822Name` | false | 主体邮箱/标识；用于判断是否属于 `med.example.com` 域 |

==原始请求等效json：==
{
 "sub": {
    "subjectId": "bart.simpson@med.example.com"
  },
  "obj": {
    "resourceId": "file://example/med/record/patient/BartSimpson"
  },
  "act": {
    "actionId": "read"
  }
}
==转换版说明：==
- 原例是单一企业内部访问策略，不是本课题“平台托管双合约”场景。为自圆其说，将其置于“Medi Corp 内部医疗资源平台”语境： 

-- Platform 承担身份/角色管理、核心业务授权、安全合规、生命周期治理义务；

- 原 XACML 只有主体域约束，因此本文件只含一份 policy，不强行拆两份合约。 

- 映射：  rfc822Name-match("med.example.com", subject-id) -> subject.subjectId endsWith "@med.example.com" 

- 原始请求之外需要获取的其它信息：
==转换版：==
policySet "OASIS3_5_MediCorpAccess" {
    // CBAC 追加：请求模型（判决引擎统一输入）
    request AuthorizationRequest {
        subject: Subject
        resource: Resource
        action: Action
        environment: Environment
    }

    combine denyOverrides	        //    XACML 上层组合逻辑

    policy "MediCorpInternalAccess" signedBy [Subject, Platform] {

        party Subject {		        // SPESC 原生参与方 ----
            subjectId: rfc822Name
            name: String
            department: String
            employmentStatus: String
        }

        party Platform {		 // Platform 的“系统设计义务”，由 SPESC term 声明。
            account: String
            authorize(role: String, subjectId: String)   // 身份/角色管理
            audit(actionId: String, subjectId: String)   // 安全/合规执行
            suspend(subjectId: String)                   // 治理/处罚
            revoke(subjectId: String)                    // 生命周期终止
        }

        // ---- SPESC 原生：资产 ----
        asset Resource {
            info {
                resourceId: String
                resourceType: String
                department: String
            }
            right { }
        }

        // ---- SPESC term：法律/义务声明（不参与 Permit/Deny）----

        // 身份与角色管理：平台有义务为域内用户派生 internal-user 角色
        term IdentityRoleManagement: Platform must authorize("internal-user", Subject::subjectId)
            when Subject::subjectId endsWith "@med.example.com".

        // 安全与合规执行：平台有义务对访问动作审计
        term SecurityComplianceAudit: Platform must audit(action.actionId, Subject::subjectId)
            when action.actionId in ["read", "download", "export"].

        // 生命周期治理：员工离岗时平台有义务吊销访问资格
        term LifecycleRevoke: Platform must revoke(Subject::subjectId)
            when Subject::employmentStatus = "terminated".

        combine permitOverrides	//    XACML 下层组合逻辑

        access "AnyMedDomainUserAnyAction" {         // 原始 XACML 规则：域内用户可对任何资源执行任何动作
            target {
                subject.subjectId endsWith "@med.example.com"
            }
            effect Permit
        }

        signature { algorithm "ECDSA"; keyId "medi-subject-template-001"; digest "sha256:..." }
        signature { algorithm "ECDSA"; keyId "medi-platform-001"; digest "sha256:..." }
    }
}
*