ONAP-PAP-REST/src/main/resources/Decision_GuardBLPolicyTemplate.xml

   1 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
   2 <Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="urn:com:xacml:policy:id:d56af069-6cf1-430c-ba07-e26602e06a52" Version="1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:permit-unless-deny">
   3     <Description>${description}</Description>
   4     <Target>
   5         <AnyOf>
   6             <AllOf>
   7                 <Match MatchId="org.onap.function.regex-match">
   8                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">${PolicyName}</AttributeValue>
   9                     <AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="PolicyName" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  10                 </Match>
  11             </AllOf>
  12             <AllOf>
  13                 <Match MatchId="org.onap.function.regex-match">
  14                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">${ONAPName}</AttributeValue>
  15                     <AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="ONAPName" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  16                 </Match>
  17                 <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
  18                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">(?i)${actor}</AttributeValue>
  19                     <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="actor" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  20                 </Match>
  21                 <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
  22                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">(?i)${recipe}</AttributeValue>
  23                     <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="recipe" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  24                 </Match>
  25                 <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match">
  26                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">${clname}</AttributeValue>
  27                     <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="clname" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  28                 </Match>
  29             </AllOf>
  30         </AnyOf>
  31     </Target>
  32     <Rule RuleId="urn:com:xacml:rule:id:284d9393-f861-4250-b62d-fc36640a363a" Effect="Permit">
  33         <Target>
  34             <AnyOf>
  35                 <AllOf>
  36                     <Match MatchId="urn:oasis:names:tc:xacml:3.0:function:string-equal-ignore-case">
  37                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">DECIDE</AttributeValue>
  38                         <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  39                     </Match>
  40                 </AllOf>
  41             </AnyOf>
  42         </Target>
  43         <Condition>
  44                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
  45                                 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
  46                     <Apply FunctionId="urn:oasis:names:tc:xacml:2.0:function:time-in-range">
  47                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
  48                             <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" DataType="http://www.w3.org/2001/XMLSchema#time" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" MustBePresent="false"/>
  49                         </Apply>
  50                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">${guardActiveStart}</AttributeValue>
  51                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">${guardActiveEnd}</AttributeValue>
  52                     </Apply>
  53                                         <Apply FunctionId="urn:oasis:names:tc:xacml:3.0:function:any-of">
  54                                                 <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
  55                                                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
  56                                                                 <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="target" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  57                                                         </Apply>
  58                                                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
  59                                                                 <!-- <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">vserver.vserver-name</AttributeValue>-->
  60                                                                 ${blackListElement}
  61                                                         </Apply>
  62                                         </Apply>
  63                 </Apply>
  64             </Apply>
  65         </Condition>
  66     </Rule>
  67     <Rule RuleId="urn:com:xacml:rule:id:284d9393-f861-4250-b62d-fc36640a363a" Effect="Deny">
  68         <Target>
  69             <AnyOf>
  70                 <AllOf>
  71                     <Match MatchId="urn:oasis:names:tc:xacml:3.0:function:string-equal-ignore-case">
  72                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">DECIDE</AttributeValue>
  73                         <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  74                     </Match>
  75                 </AllOf>
  76             </AnyOf>
  77         </Target>
  78         <Condition>
  79             <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
  80                 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
  81                                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
  82                                                 <Apply FunctionId="urn:oasis:names:tc:xacml:2.0:function:time-in-range">
  83                                                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
  84                                                                 <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" DataType="http://www.w3.org/2001/XMLSchema#time" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" MustBePresent="false"/>
  85                                                         </Apply>
  86                                                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">${guardActiveStart}</AttributeValue>
  87                                                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#time">${guardActiveEnd}</AttributeValue>
  88                                                 </Apply>
  89                                                 <Apply FunctionId="urn:oasis:names:tc:xacml:3.0:function:any-of">
  90                                                         <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
  91                                                                 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
  92                                                                         <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="target" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  93                                                                 </Apply>
  94                                                                 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
  95                                                                         <!-- <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">vserver.vserver-name</AttributeValue>-->
  96                                                                         ${blackListElement}
  97                                                                 </Apply>
  98                                                 </Apply>
  99                                         </Apply>
 100                                 </Apply>
 101             </Apply>
 102         </Condition>
 103         <AdviceExpressions>
 104             <AdviceExpression AdviceId="GUARD_BL_YAML" AppliesTo="Deny">
 105                 <AttributeAssignmentExpression AttributeId="guard.response" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">
 106                     <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Denied!</AttributeValue>
 107                 </AttributeAssignmentExpression>
 108             </AdviceExpression>
 109         </AdviceExpressions>
 110     </Rule>
 111 </Policy>