查看“CBAC”的源代码

<meta charset="utf-8" />
<meta property="mw:pageId" content="75" />
<meta property="mw:pageNamespace" content="0" />

<meta property="mw:revisionSHA1" content="c14026e9edf9ff3dd34d05da43c296c7fa910e7e" />
<meta property="dc:modified" content="2026-09-03T00:50:26.000Z" />
<meta property="mw:html:version" content="2.1.0" />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]
<meta http-equiv="content-language" content="zh-cn" />
<meta http-equiv="vary" content="Accept" />
meta
<meta property="mw:pageId" content="75" />
<meta property="mw:pageNamespace" content="0" />

<meta property="mw:revisionSHA1" content="c14026e9edf9ff3dd34d05da43c296c7fa910e7e" />
<meta property="dc:modified" content="2026-09-03T00:50:26.000Z" />
<meta property="mw:html:version" content="2.1.0" />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC] pro[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]perty="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" />
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" />
<meta property="mw:html:version" content="2.1.0" />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]




<nowiki>= 总体顺序 =</nowiki>

target term

                │ 只做资源级适用性判断，不引用具体 comb

                ▼  （编译器自动按 Request::Act.actionId 查找对应 comb；  （无 comb 则找同动作 rule_target））

comb term（组合入口，针对一类动作）

               │ 在 when 中 evalTerm(rule_target, Request) = Permit

               ▼

rule_target term（动作、rule级obligation、rule级target、伴随、后置）

               │ 在 when 中 evalTerm(rule_condition, Request) = Permit

             ▼

rule_condition term（condition和返回）


=例1：sample6=
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/

说明：多rule合并
==原文：==
<syntaxhighlight lang="xml">
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" 
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Description>Test Or</Description>
   <Target></Target>
   <Rule Effect="Permit" RuleId="primary-group-emps-rule">  
      <Target>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
                  Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
               </Match>
            </AllOf>
         </AnyOf>
      </Target>
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" 
            Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Permit" RuleId="primary-user-rule"> 
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" 
            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="deny-rule"></Rule>
</Policy>
</syntaxhighlight>
==逻辑结构：==
Policy (组合: first-applicable) 

├── Target = 空

├── Rule1 (Permit)

│ ├── Target: action-id = read

│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集

├── Rule2 (Permit)

│ ├── Target: 无

│ └── Condition: resource-id 与 {<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>, <nowiki>http://localhost:8280/services/Customers/getVersion2}</nowiki> 有交集

└── Rule3 (Deny) 兜底

==原始请求等效json：==
 {
   "sub": {
     "subjectId": "anyone",
     "groups": []
   },
   "act": {
     "actionId": "read"
   },
   "obj": {
     "resourceId": "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>"
   }
 }

==转换版：==
contract Sample6_RoleAccess {

    party Platform {

        name: String

        targetMatch(Request)

    }

    asset Resource {

        resourceId: String

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    ## Type(match)

    term policy_target: Platform must targetMatch(Request)

        when true

        where return Permit

    ## Type(comb)

    term policy_comb: Sub can access Resource

        when some of(evalTerm(rule_target_1, Request),

                     evalTerm(rule_target_2, Request)) = Permit

        where return Permit

    term rule_target_1: Sub can read Resource

        when ATTR(Request::Act, actionId) = "read"

          and "admin_emps" belong ATTR(Request::Sub, groups)

        where return Permit

    term rule_target_2: Sub can access Resource

        when when ATTR(Request::Obj, resourceId) in {

            "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",

            "<nowiki>http://localhost:8280/services/Customers/getVersion2</nowiki>"

        }

        where return Permit

}


=例2：OASIS 3-4=
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502

语法：双target，有obligation
==原文：==
<syntaxhighlight lang="xml">
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="copyright-approve"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"
    Version="1">
    <Description>Example copyright material policy</Description>

    <!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant -->
    <Target>
        <AnyOf>
            <AllOf>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/>
                </Match>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/>
                </Match>
            </AllOf>
        </AnyOf>
    </Target>

    <!-- 规则级 Target：资源 ip-owner = Acme -->
    <Rule Effect="Permit" RuleId="Right to use copyrighted material match">
        <Description>Allow if subject's association to the designated custodian of the copyright agrees</Description>
        <Target>
            <AnyOf>
                <AllOf>
                    <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue>
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Match>
                </AllOf>
            </AnyOf>
        </Target>

        <!-- Condition：以下 5 个条件全部成立才 Permit -->
        <Condition>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                <!-- ① 请求方组织 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ② 主体协议号 = 资源协议号 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ③ 资源被许可方 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ④ 当前时间 >= 生效时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ⑤ 当前时间 < 过期时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
            </Apply>
        </Condition>
    </Rule>

    <!-- Permit 时要求 PEP：加标记 + 加密 -->
    <ObligationExpressions>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit">
            <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue>
            </AttributeAssignmentExpression>
        </ObligationExpression>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/>
    </ObligationExpressions>
</Policy>
</syntaxhighlight>
==逻辑结构：==
Policy copyright-approve (deny-overrides) 

├── Target: resource:copyright = true

│           AND resource:agreement-type = <nowiki>urn:...:copyright-grant</nowiki>

└── Rule "Right to use copyrighted material match" (Permit)

|   ├── Target: resource:ip-owner = "Acme"

|   └── Condition (AND):

|       ├── subject:organization = "Wiley Corp"

|       ├── subject:agreement-id = resource:agreement-id

|       ├── resource:ip-licensee = "Wiley Corp"

|       ├── current-dateTime >= resource:effective-date

|       └── current-dateTime 小于 resource:expiration-date

└── Obligations (Permit):

    ├── marking(text = "Copyright 2011 Acme")

    └── encrypt

==原始请求等效json： ==
  {
   "sub": {
     "organization": "Wiley Corp",
     "agreementId": "A-001"
   },
   "obj": {
     "copyright": true,
     "ipOwner": "Acme",
     "ipLicensee": "Wiley Corp",
     "agreementType": "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>",
     "agreementId": "A-001",
     "effectiveDate": "2020-01-01T00:00:00",
     "expirationDate": "2030-01-01T00:00:00"
   },
   "act": {
     "actionId": "use"
   },
   "env": {
     "currentDateTime": "2024-06-01T12:00:00"
   }
 }

==转换版：==

contract CopyrightApprove {

    party Owner {

        name: String

    }

    party Platform {

        name: String

        targetMatch(Request)

        marking(text: String)

        encrypt()

    }

    asset Resource {

        resourceId: String

        copyright: Boolean

        agreementType: String

        ipOwner: String

        ipLicensee: String

        agreementId: String

        effectiveDate: dateTime

        expirationDate: dateTime

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    addition fn {

        oneAndOnly(x: String): String

        oneAndOnly(x: dateTime): dateTime

    }

    ## Type(match)

    term policy_target: Platform must targetMatch(Request)

        when ATTR(Request::Obj, copyright) = true

          and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"

        where return Permit

    ## Type(comb)

    term policy_comb: Sub can access Resource

        when evalTerm(rule_target, Request) = Permit

        where evalTerm(obligation_mark, Request) AND evalTerm(obligation_encrypt, Request)

          AND return Permit

    term rule_target: Sub can use Resource

        when ATTR(Request::Obj, ipOwner) = "Acme"

          and  ATTR(Request::Sub, organization) = "Wiley Corp"

          and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =

              fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))

          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"

          and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))

          and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))

        where return Permit

    term obligation_mark: Platform must marking("Copyright 2011 Acme")

        when true

    term obligation_encrypt: Platform must encrypt()

        when true

}
*