查看“CBAC”的源代码

<meta charset="utf-8" />
<meta property="mw:pageId" content="75" />
<meta property="mw:pageNamespace" content="0" />

<meta property="mw:revisionSHA1" content="6484283d6d9200fc6e16e86fda94ddc6c13a9b49" />
<meta property="dc:modified" content="2026-09-03T01:08:50.000Z" />
<meta property="mw:html:version" content="2.1.0" />
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]
<meta http-equiv="content-language" content="zh-cn" />
<meta http-equiv="vary" content="Accept" />
----

== 概览 ==


更新时间：2026.9.4

将语言最简化，去除了将combination逻辑中，使用evalterm和逻辑谓词表达的方法。理由：在没有ifelse的情况下，无法表达其中某种组合逻辑。obligation的选取完全无法脱离if-else完成。

成功转换了100+个从oasis官网获取的example

下一步安排：在方磊制作的网页上上传10个精选版（周五夜里）

下一步安排：寻找一些更复杂的例子（周五夜里）

下一步安排：精进栈式判决测试，完善例子的输入，寻找xacml执行器并进行对比，在确认正确后进行效率测试（周六）

一、基本结构

TODO


二、执行顺序：

（1）Target Term，只做资源级适用性判断，包含when逻辑并调用

（2）Authentic  Term：在运行前临时进行变量赋值逻辑

when 条件

while 赋值

（3）rule_term

when：rule级target

where：condition

while：rule级obligation

(4)   obligation_term：policy级的义务，在最后执行

使用while调用platform的函数
=例1：sample6=
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/
==原文：==
<syntaxhighlight lang="xml">
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" 
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Description>Test Or</Description>
   <Target></Target>
   <Rule Effect="Permit" RuleId="primary-group-emps-rule">  
      <Target>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
                  Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
               </Match>
            </AllOf>
         </AnyOf>
      </Target>
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" 
            Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Permit" RuleId="primary-user-rule"> 
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" 
            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="deny-rule"></Rule>
</Policy>
</syntaxhighlight>
==逻辑结构：==
Policy (组合: first-applicable) 

├── Target = 空

├── Rule1 (Permit)

│ ├── Target: action-id = read

│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集

├── Rule2 (Permit)

│ ├── Target: 无

│ └── Condition: resource-id 与 {<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>, <nowiki>http://localhost:8280/services/Customers/getVersion2}</nowiki> 有交集

└── Rule3 (Deny) 兜底

==原始请求等效json：==
 {
   "sub": {
     "subjectId": "anyone",
     "groups": []
   },
   "act": {
     "actionId": "read"
   },
   "obj": {
     "resourceId": "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>"
   }
 }

==转换版：==
contract Sample6_RoleAccess {

    party Sub {

        subjectId: String

        groups: set String

    }

    asset Resource {

        resourceId: String

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    addition fn {

        regexpMatch(value: String, pattern: String): Boolean

    }

    combineAlgorithm = first-applicable

    ## Type(target)

    term policy_target: Platform must targetMatch(Request)

    term primaryGroupEmpsRule: Sub can read Resource

        when ATTR(Request::Act, actionId) = "read"

        where ATTR(Request::Sub, groups) overlaps {"admin_emps", "admin"}

    term primaryUserRule: Sub can access Resource

        where ATTR(Request::Obj, resourceId) belong {

            "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",

            "<nowiki>http://localhost:8280/services/Customers/getVersion2</nowiki>"

        }

    term denyRule: Sub cannot access Resource

}


=例2：OASIS 3-4=
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502

语法：双target，有obligation
==原文：==
<syntaxhighlight lang="xml">
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="copyright-approve"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"
    Version="1">
    <Description>Example copyright material policy</Description>

    <!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant -->
    <Target>
        <AnyOf>
            <AllOf>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/>
                </Match>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/>
                </Match>
            </AllOf>
        </AnyOf>
    </Target>

    <!-- 规则级 Target：资源 ip-owner = Acme -->
    <Rule Effect="Permit" RuleId="Right to use copyrighted material match">
        <Description>Allow if subject's association to the designated custodian of the copyright agrees</Description>
        <Target>
            <AnyOf>
                <AllOf>
                    <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue>
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Match>
                </AllOf>
            </AnyOf>
        </Target>

        <!-- Condition：以下 5 个条件全部成立才 Permit -->
        <Condition>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                <!-- ① 请求方组织 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ② 主体协议号 = 资源协议号 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ③ 资源被许可方 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ④ 当前时间 >= 生效时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ⑤ 当前时间 < 过期时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
            </Apply>
        </Condition>
    </Rule>

    <!-- Permit 时要求 PEP：加标记 + 加密 -->
    <ObligationExpressions>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit">
            <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue>
            </AttributeAssignmentExpression>
        </ObligationExpression>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/>
    </ObligationExpressions>
</Policy>
</syntaxhighlight>
==逻辑结构：==
Policy copyright-approve (deny-overrides) 

├── Target: resource:copyright = true

│           AND resource:agreement-type = <nowiki>urn:...:copyright-grant</nowiki>

└── Rule "Right to use copyrighted material match" (Permit)

|   ├── Target: resource:ip-owner = "Acme"

|   └── Condition (AND):

|       ├── subject:organization = "Wiley Corp"

|       ├── subject:agreement-id = resource:agreement-id

|       ├── resource:ip-licensee = "Wiley Corp"

|       ├── current-dateTime >= resource:effective-date

|       └── current-dateTime 小于 resource:expiration-date

└── Obligations (Permit):

    ├── marking(text = "Copyright 2011 Acme")

    └── encrypt

==原始请求等效json： ==
  {
   "sub": {
     "organization": "Wiley Corp",
     "agreementId": "A-001"
   },
   "obj": {
     "copyright": true,
     "ipOwner": "Acme",
     "ipLicensee": "Wiley Corp",
     "agreementType": "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>",
     "agreementId": "A-001",
     "effectiveDate": "2020-01-01T00:00:00",
     "expirationDate": "2030-01-01T00:00:00"
   },
   "act": {
     "actionId": "use"
   },
   "env": {
     "currentDateTime": "2024-06-01T12:00:00"
   }
 }

==转换版：==

contract CopyrightApprove {

    party Sub {

        organization: String

        agreementId: String

    }

    party Platform {

        marking(trigger: OrderState, text: String)

        encrypt(trigger: OrderState)

    }

    asset Resource {

        copyright: Boolean

        agreementType: String

        ipOwner: String

        ipLicensee: String

        agreementId: String

        effectiveDate: dateTime

        expirationDate: dateTime

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    addition fn {

        oneAndOnly(x: String): String

        oneAndOnly(x: dateTime): dateTime

    }

    enum OrderState {

        Permit, Deny

    }

    combineAlgorithm = deny-overrides

    ## Type(target)

    term policy_target: Platform must targetMatch(Request)

        when ATTR(Request::Obj, copyright) = true

          and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"

    term rightsToUse: Sub can use Resource

        when ATTR(Request::Obj, ipOwner) = "Acme"

        where ATTR(Request::Sub, organization) = "Wiley Corp"

          and oneAndOnly(ATTR(Request::Sub, agreementId)) =

              oneAndOnly(ATTR(Request::Obj, agreementId))

          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"

          and now >= oneAndOnly(ATTR(Request::Obj, effectiveDate))

          and now < oneAndOnly(ATTR(Request::Obj, expirationDate))

    ## Type(obligation)

    term policy_obligation: Platform must fulfillObligations(Request)

        while marking(Permit, "Copyright 2011 Acme")

          and encrypt(Permit)

}
*