“CBAC”的版本间的差异
| 第1行： | 第1行： | ||
| + | | ||
| + | <meta charset="utf-8" /> | ||
| + | <meta property="mw:pageId" content="75" /> | ||
| + | <meta property="mw:pageNamespace" content="0" /> | ||
| + | |||
| + | <meta property="mw:revisionSHA1" content="47b34894dfcc793815ae7ed1a7708a06e76c11c8" /> | ||
| + | <meta property="dc:modified" content="2026-09-03T01:05:36.000Z" /> | ||
| + | <meta property="mw:html:version" content="2.1.0" /> | ||
| + | [https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]--> | ||
| + | <meta http-equiv="content-language" content="zh-cn" /> | ||
| + | <meta http-equiv="vary" content="Accept" /> | ||
| + | |||
<meta charset="utf-8" /> | <meta charset="utf-8" /> | ||
<meta property="mw:pageId" content="75" /> | <meta property="mw:pageId" content="75" /> | ||
| 第20行： | 第32行： | ||
<meta property="mw:html:version" content="2.1.0" /> | <meta property="mw:html:version" content="2.1.0" /> | ||
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector] | [https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector] | ||
| + | |||
| 第177行： | 第190行： | ||
when ATTR(Request::Act, actionId) = "read" | when ATTR(Request::Act, actionId) = "read" | ||
| − | and "admin_emps" | + | and "admin_emps" in ATTR(Request::Sub, groups) |
where return Permit | where return Permit | ||
2026年9月3日 (四) 03:08的版本
<meta charset="utf-8" /> <meta property="mw:pageId" content="75" /> <meta property="mw:pageNamespace" content="0" />
<meta property="mw:revisionSHA1" content="47b34894dfcc793815ae7ed1a7708a06e76c11c8" /> <meta property="dc:modified" content="2026-09-03T01:05:36.000Z" /> <meta property="mw:html:version" content="2.1.0" /> [1]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector] <meta http-equiv="content-language" content="zh-cn" /> <meta http-equiv="vary" content="Accept" />
<meta charset="utf-8" /> <meta property="mw:pageId" content="75" /> <meta property="mw:pageNamespace" content="0" />
<meta property="mw:revisionSHA1" content="c14026e9edf9ff3dd34d05da43c296c7fa910e7e" /> <meta property="dc:modified" content="2026-09-03T00:50:26.000Z" /> <meta property="mw:html:version" content="2.1.0" /> [2][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector] <meta http-equiv="content-language" content="zh-cn" /> <meta http-equiv="vary" content="Accept" /> meta <meta property="mw:pageId" content="75" /> <meta property="mw:pageNamespace" content="0" />
<meta property="mw:revisionSHA1" content="c14026e9edf9ff3dd34d05da43c296c7fa910e7e" /> <meta property="dc:modified" content="2026-09-03T00:50:26.000Z" /> <meta property="mw:html:version" content="2.1.0" /> [3] pro[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]perty="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /> <meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /> <meta property="mw:html:version" content="2.1.0" /> [4]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]
= 总体顺序 =
target term
│ 只做资源级适用性判断，不引用具体 comb
▼ （编译器自动按 Request::Act.actionId 查找对应 comb； （无 comb 则找同动作 rule_target））
comb term（组合入口，针对一类动作）
│ 在 when 中 evalTerm(rule_target, Request) = Permit
▼
rule_target term（动作、rule级obligation、rule级target、伴随、后置）
│ 在 when 中 evalTerm(rule_condition, Request) = Permit
▼
rule_condition term（condition和返回）
例1：sample6
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/
说明：多rule合并
原文：
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr"
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
<Description>Test Or</Description>
<Target></Target>
<Rule Effect="Permit" RuleId="primary-group-emps-rule">
<Target>
<AnyOf>
<AllOf>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
</Match>
</AllOf>
</AnyOf>
</Target>
<Condition>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
<AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string"
Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue>
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
</Apply>
</Apply>
</Condition>
</Rule>
<Rule Effect="Permit" RuleId="primary-user-rule">
<Condition>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue>
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue>
</Apply>
</Apply>
</Condition>
</Rule>
<Rule Effect="Deny" RuleId="deny-rule"></Rule>
</Policy>逻辑结构：
Policy (组合: first-applicable)
├── Target = 空
├── Rule1 (Permit)
│ ├── Target: action-id = read
│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集
├── Rule2 (Permit)
│ ├── Target: 无
│ └── Condition: resource-id 与 {http://localhost:8280/services/Customers/getVersion1, http://localhost:8280/services/Customers/getVersion2} 有交集
└── Rule3 (Deny) 兜底
原始请求等效json：
{
"sub": {
"subjectId": "anyone",
"groups": []
},
"act": {
"actionId": "read"
},
"obj": {
"resourceId": "http://localhost:8280/services/Customers/getVersion1"
}
}
转换版：
contract Sample6_RoleAccess {
party Platform {
name: String
targetMatch(Request)
}
asset Resource {
resourceId: String
}
addition Request {
Sub: Subject
Obj: Resource
Act: Action
}
## Type(match)
term policy_target: Platform must targetMatch(Request)
when true
where return Permit
## Type(comb)
term policy_comb: Sub can access Resource
when some of(evalTerm(rule_target_1, Request),
evalTerm(rule_target_2, Request)) = Permit
where return Permit
term rule_target_1: Sub can read Resource
when ATTR(Request::Act, actionId) = "read"
and "admin_emps" in ATTR(Request::Sub, groups)
where return Permit
term rule_target_2: Sub can access Resource
when when ATTR(Request::Obj, resourceId) in {
"http://localhost:8280/services/Customers/getVersion1",
"http://localhost:8280/services/Customers/getVersion2"
}
where return Permit
}
例2：OASIS 3-4
来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502
语法：双target，有obligation
原文：
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
PolicyId="copyright-approve"
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"
Version="1">
<Description>Example copyright material policy</Description>
<!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant -->
<Target>
<AnyOf>
<AllOf>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue>
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/>
</Match>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue>
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/>
</Match>
</AllOf>
</AnyOf>
</Target>
<!-- 规则级 Target：资源 ip-owner = Acme -->
<Rule Effect="Permit" RuleId="Right to use copyrighted material match">
<Description>Allow if subject's association to the designated custodian of the copyright agrees</Description>
<Target>
<AnyOf>
<AllOf>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue>
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
</Match>
</AllOf>
</AnyOf>
</Target>
<!-- Condition：以下 5 个条件全部成立才 Permit -->
<Condition>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
<!-- ① 请求方组织 = Wiley Corp -->
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
</Apply>
</Apply>
<!-- ② 主体协议号 = 资源协议号 -->
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
</Apply>
</Apply>
<!-- ③ 资源被许可方 = Wiley Corp -->
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
</Apply>
</Apply>
<!-- ④ 当前时间 >= 生效时间 -->
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
</Apply>
</Apply>
<!-- ⑤ 当前时间 < 过期时间 -->
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"
Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
</Apply>
</Apply>
</Apply>
</Condition>
</Rule>
<!-- Permit 时要求 PEP：加标记 + 加密 -->
<ObligationExpressions>
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit">
<AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue>
</AttributeAssignmentExpression>
</ObligationExpression>
<ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/>
</ObligationExpressions>
</Policy>逻辑结构：
Policy copyright-approve (deny-overrides)
├── Target: resource:copyright = true
│ AND resource:agreement-type = urn:...:copyright-grant
└── Rule "Right to use copyrighted material match" (Permit)
| ├── Target: resource:ip-owner = "Acme"
| └── Condition (AND):
| ├── subject:organization = "Wiley Corp"
| ├── subject:agreement-id = resource:agreement-id
| ├── resource:ip-licensee = "Wiley Corp"
| ├── current-dateTime >= resource:effective-date
| └── current-dateTime 小于 resource:expiration-date
└── Obligations (Permit):
├── marking(text = "Copyright 2011 Acme")
└── encrypt
原始请求等效json：
{
"sub": {
"organization": "Wiley Corp",
"agreementId": "A-001"
},
"obj": {
"copyright": true,
"ipOwner": "Acme",
"ipLicensee": "Wiley Corp",
"agreementType": "urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant",
"agreementId": "A-001",
"effectiveDate": "2020-01-01T00:00:00",
"expirationDate": "2030-01-01T00:00:00"
},
"act": {
"actionId": "use"
},
"env": {
"currentDateTime": "2024-06-01T12:00:00"
}
}
转换版：
contract CopyrightApprove {
party Owner {
name: String
}
party Platform {
name: String
targetMatch(Request)
marking(text: String)
encrypt()
}
asset Resource {
resourceId: String
copyright: Boolean
agreementType: String
ipOwner: String
ipLicensee: String
agreementId: String
effectiveDate: dateTime
expirationDate: dateTime
}
addition Request {
Sub: Subject
Obj: Resource
Act: Action
}
addition fn {
oneAndOnly(x: String): String
oneAndOnly(x: dateTime): dateTime
}
## Type(match)
term policy_target: Platform must targetMatch(Request)
when ATTR(Request::Obj, copyright) = true
and ATTR(Request::Obj, agreementType) = "urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant"
where return Permit
## Type(comb)
term policy_comb: Sub can access Resource
when evalTerm(rule_target, Request) = Permit
where evalTerm(obligation_mark, Request) AND evalTerm(obligation_encrypt, Request)
AND return Permit
term rule_target: Sub can use Resource
when ATTR(Request::Obj, ipOwner) = "Acme"
and ATTR(Request::Sub, organization) = "Wiley Corp"
and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =
fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))
and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"
and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))
and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))
where return Permit
term obligation_mark: Platform must marking("Copyright 2011 Acme")
when true
term obligation_encrypt: Platform must encrypt()
when true
}