packages/base/src/files/install/servers/console/bin/Policy-Admin.xml

   1 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
   2 <!--
   3   ============LICENSE_START=======================================================
   4   ONAP Policy Engine
   5   ================================================================================
   6   Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
   7   ================================================================================
   8   Licensed under the Apache License, Version 2.0 (the "License");
   9   you may not use this file except in compliance with the License.
  10   You may obtain a copy of the License at
  11
  12        http://www.apache.org/licenses/LICENSE-2.0
  13
  14   Unless required by applicable law or agreed to in writing, software
  15   distributed under the License is distributed on an "AS IS" BASIS,
  16   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  17   See the License for the specific language governing permissions and
  18   limitations under the License.
  19   ============LICENSE_END=========================================================
  20   -->
  21
  22 <PolicySet xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicySetId="urn:com:att:xacml:policy:id:3db6785b-9343-4d1f-aa87-1470f7c64e42" Version="2" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:first-applicable">
  23     <Description>Extremely simple policy for accessing the admin console. If you are &quot;admin&quot; you can do anything. If you are &quot;editor&quot;, you can edit policies and the dictionaries. If you are &quot;guest&quot;, you can only read or view information.</Description>
  24     <Target/>
  25     <Policy PolicyId="urn:com:att:xacml:policy:id:70a20f17-e538-4d07-8a2a-89bbdb6ca9e3" Version="1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
  26         <Description>Admin policy</Description>
  27         <Target>
  28             <AnyOf>
  29                 <AllOf>
  30                     <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
  31                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
  32                         <AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  33                     </Match>
  34                 </AllOf>
  35             </AnyOf>
  36         </Target>
  37         <Rule RuleId="urn:com:att:xacml:rule:id:07e4ea58-b2b7-41e4-a600-ebd5fb1c3114" Effect="Permit">
  38             <Description>PERMIT - application access.</Description>
  39              <Target>
  40                 <AnyOf>
  41                     <AllOf>
  42                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
  43                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">access</AttributeValue>
  44                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  45                         </Match>
  46                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
  47                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">application</AttributeValue>
  48                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  49                         </Match>
  50                     </AllOf>
  51                 </AnyOf>
  52             </Target>
  53         </Rule>
  54         <Rule RuleId="urn:com:att:xacml:rule:id:e84e5501-0f73-445c-b5de-04f2947e0637" Effect="Permit">
  55             <Description>PERMIT - any action on the admin</Description>
  56             <Target>
  57                 <AnyOf>
  58                     <AllOf>
  59                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
  60                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
  61                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  62                         </Match>
  63                     </AllOf>
  64                 </AnyOf>
  65             </Target>
  66         </Rule>
  67          <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b66-a23e-f475c41f2d91" Effect="Permit">
  68             <Description>PERMIT - any action on the roles</Description>
  69             <Target>
  70                 <AnyOf>
  71                     <AllOf>
  72                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
  73                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">workspace</AttributeValue>
  74                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  75                         </Match>
  76                     </AllOf>
  77                 </AnyOf>
  78             </Target>
  79         </Rule>
  80         <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b66-a23e-f475c41f2d41" Effect="Permit">
  81             <Description>PERMIT - any action on the dictionaries</Description>
  82             <Target>
  83                 <AnyOf>
  84                     <AllOf>
  85                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
  86                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dictionaries</AttributeValue>
  87                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
  88                         </Match>
  89                     </AllOf>
  90                 </AnyOf>
  91             </Target>
  92         </Rule>
  93          <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b69-a23e-f475c41f2d51" Effect="Permit">
  94             <Description>PERMIT - any action on the pdp</Description>
  95             <Target>
  96                 <AnyOf>
  97                     <AllOf>
  98                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
  99                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">pdp_admin</AttributeValue>
 100                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 101                         </Match>
 102                     </AllOf>
 103                 </AnyOf>
 104             </Target>
 105         </Rule>
 106          <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b69-a23e-f475c41f2d81" Effect="Permit">
 107             <Description>PERMIT - any action on the pip</Description>
 108             <Target>
 109                 <AnyOf>
 110                     <AllOf>
 111                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 112                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">pip_admin</AttributeValue>
 113                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 114                         </Match>
 115                     </AllOf>
 116                 </AnyOf>
 117             </Target>
 118         </Rule>
 119         <Rule RuleId="urn:com:att:xacml:rule:id:e4541019-4503-490f-97e0-b94251fdc669" Effect="Permit">
 120             <Description>PERMIT - admin can read</Description>
 121             <Target>
 122                 <AnyOf>
 123                     <AllOf>
 124                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 125                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
 126                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 127                         </Match>
 128                     </AllOf>
 129                 </AnyOf>
 130             </Target>
 131         </Rule>
 132          <Rule RuleId="urn:com:att:xacml:rule:id:80422fdf-5094-4609-925e-289ad226e2aa" Effect="Deny">
 133             <Description>DENY - default</Description>
 134             <Target/>
 135         </Rule>
 136         <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b66-a23e-f475c41f2d10" Effect="Deny">
 137             <Description>DENY- any action on manage scopes</Description>
 138             <Target>
 139                 <AnyOf>
 140                     <AllOf>
 141                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 142                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">manage_scopes</AttributeValue>
 143                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 144                         </Match>
 145                     </AllOf>
 146                 </AnyOf>
 147             </Target>
 148         </Rule>
 149     </Policy>
 150      <Policy PolicyId="urn:com:att:xacml:policy:id:70a20f17-e538-4d07-8a2a-89bbdb6ca9e4" Version="1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
 151         <Description>Super Admin policy</Description>
 152         <Target>
 153             <AnyOf>
 154                 <AllOf>
 155                     <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 156                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">super-admin</AttributeValue>
 157                         <AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 158                     </Match>
 159                 </AllOf>
 160             </AnyOf>
 161         </Target>
 162         <Rule RuleId="urn:com:att:xacml:rule:id:13067c96-14f7-4ab0-bea3-65d8cb0970b2" Effect="Permit">
 163             <Description>PERMIT - superadmin can do everything in the admin console.</Description>
 164             <Target/>
 165         </Rule>
 166     </Policy>
 167     <Policy PolicyId="urn:com:att:xacml:policy:id:6edb392a-0d8f-4cbo-a965-229292fd1122" Version="1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
 168         <Description>Editor Policy</Description>
 169         <Target>
 170             <AnyOf>
 171                 <AllOf>
 172                     <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 173                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">editor</AttributeValue>
 174                         <AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 175                     </Match>
 176                 </AllOf>
 177             </AnyOf>
 178         </Target>
 179         <Rule RuleId="urn:com:att:xacml:rule:id:07e4ea58-b2b7-41e4-a600-ebd5fb1c3144" Effect="Permit">
 180             <Description>PERMIT - application access.</Description>
 181              <Target>
 182                 <AnyOf>
 183                     <AllOf>
 184                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 185                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">access</AttributeValue>
 186                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 187                         </Match>
 188                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 189                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">application</AttributeValue>
 190                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 191                         </Match>
 192                     </AllOf>
 193                 </AnyOf>
 194             </Target>
 195         </Rule>
 196         <Rule RuleId="urn:com:att:xacml:rule:id:9c9ce992-196a-4da4-bbf6-4f4a88436635" Effect="Permit">
 197             <Description>PERMIT - R/W workspace</Description>
 198             <Target/>
 199             <Condition>
 200                 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
 201                     <Description>The action is read or write AND the resource is the workspace.</Description>
 202                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
 203                         <Description>Action is Read OR Write</Description>
 204                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 205                             <Description>Is action = read?</Description>
 206                             <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
 207              <Description>Un-bag</Description>
 208         <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 209                             </Apply>
 210                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
 211                         </Apply>
 212                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 213                             <Description>Is action = write?</Description>
 214                             <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
 215             <Description>Un-bag</Description>
 216          <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 217                             </Apply>
 218                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue>
 219                         </Apply>
 220                     </Apply>
 221                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 222                         <Description>resource is workspace</Description>
 223                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
 224                             <Description>Un-bag</Description>
 225                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 226                         </Apply>
 227                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">workspace</AttributeValue>
 228                     </Apply>
 229                 </Apply>
 230             </Condition>
 231         </Rule>
 232         <Rule RuleId="urn:com:att:xacml:rule:id:e84e5501-0f73-445c-b5de-04f2947e0677" Effect="Permit">
 233             <Description>PERMIT - any action on the editor</Description>
 234             <Target>
 235                 <AnyOf>
 236                     <AllOf>
 237                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 238                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">editor</AttributeValue>
 239                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 240                         </Match>
 241                     </AllOf>
 242                 </AnyOf>
 243             </Target>
 244         </Rule>
 245         <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b66-a23e-f475c41f2d11" Effect="Deny">
 246             <Description>PERMIT - any action on the dictionaries</Description>
 247             <Target>
 248                 <AnyOf>
 249                     <AllOf>
 250                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 251                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dictionaries</AttributeValue>
 252                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 253                         </Match>
 254                     </AllOf>
 255                 </AnyOf>
 256             </Target>
 257         </Rule>
 258          <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b69-a23e-f475c41f2d11" Effect="Permit">
 259             <Description>PERMIT - any action on the dictionaries</Description>
 260             <Target>
 261                 <AnyOf>
 262                     <AllOf>
 263                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 264                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">pdp_admin</AttributeValue>
 265                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 266                         </Match>
 267                     </AllOf>
 268                 </AnyOf>
 269             </Target>
 270         </Rule>
 271         <Rule RuleId="urn:com:att:xacml:rule:id:e4541019-4503-490f-97e0-b94251fdc629" Effect="Permit">
 272             <Description>PERMIT - editor can read</Description>
 273             <Target>
 274                 <AnyOf>
 275                     <AllOf>
 276                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 277                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
 278                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 279                         </Match>
 280                     </AllOf>
 281                 </AnyOf>
 282             </Target>
 283         </Rule>
 284         <Rule RuleId="urn:com:att:xacml:rule:id:80422fdf-5094-4609-925e-289ad226e2aa" Effect="Deny">
 285             <Description>DENY - default</Description>
 286             <Target/>
 287         </Rule>
 288     </Policy>
 289      <Policy PolicyId="urn:com:att:xacml:policy:id:6edb392a-0d8f-4cbo-a965-229292fd1122" Version="1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
 290         <Description>Super Editor Policy</Description>
 291         <Target>
 292             <AnyOf>
 293                 <AllOf>
 294                     <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 295                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">super-editor</AttributeValue>
 296                         <AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 297                     </Match>
 298                 </AllOf>
 299             </AnyOf>
 300         </Target>
 301         <Rule RuleId="urn:com:att:xacml:rule:id:07e4ea58-b2b7-41e4-a600-ebd5fb1c3144" Effect="Permit">
 302             <Description>PERMIT - application access.</Description>
 303              <Target>
 304                 <AnyOf>
 305                     <AllOf>
 306                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 307                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">access</AttributeValue>
 308                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 309                         </Match>
 310                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 311                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">application</AttributeValue>
 312                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 313                         </Match>
 314                     </AllOf>
 315                 </AnyOf>
 316             </Target>
 317         </Rule>
 318         <Rule RuleId="urn:com:att:xacml:rule:id:9c9ce992-196a-4da4-bbf6-4f4a88436635" Effect="Permit">
 319             <Description>PERMIT - R/W workspace</Description>
 320             <Target/>
 321             <Condition>
 322                 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
 323                     <Description>The action is read or write AND the resource is the workspace.</Description>
 324                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
 325                         <Description>Action is Read OR Write</Description>
 326                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 327                             <Description>Is action = read?</Description>
 328                             <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
 329              <Description>Un-bag</Description>
 330         <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 331                             </Apply>
 332                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
 333                         </Apply>
 334                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 335                             <Description>Is action = write?</Description>
 336                             <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
 337             <Description>Un-bag</Description>
 338          <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 339                             </Apply>
 340                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue>
 341                         </Apply>
 342                     </Apply>
 343                     <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 344                         <Description>resource is workspace</Description>
 345                         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
 346                             <Description>Un-bag</Description>
 347                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 348                         </Apply>
 349                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">workspace</AttributeValue>
 350                     </Apply>
 351                 </Apply>
 352             </Condition>
 353         </Rule>
 354         <Rule RuleId="urn:com:att:xacml:rule:id:e84e5501-0f73-445c-b5de-04f2947e0677" Effect="Permit">
 355             <Description>PERMIT - any action on the super editor</Description>
 356             <Target>
 357                 <AnyOf>
 358                     <AllOf>
 359                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 360                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">super-editor</AttributeValue>
 361                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 362                         </Match>
 363                     </AllOf>
 364                 </AnyOf>
 365             </Target>
 366         </Rule>
 367         <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b66-a23e-f475c41f2d11" Effect="Deny">
 368             <Description>PERMIT - any action on the dictionaries</Description>
 369             <Target>
 370                 <AnyOf>
 371                     <AllOf>
 372                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 373                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dictionaries</AttributeValue>
 374                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 375                         </Match>
 376                     </AllOf>
 377                 </AnyOf>
 378             </Target>
 379         </Rule>
 380          <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b69-a23e-f475c41f2d11" Effect="Permit">
 381             <Description>PERMIT - any action on the dictionaries</Description>
 382             <Target>
 383                 <AnyOf>
 384                     <AllOf>
 385                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 386                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">pdp_admin</AttributeValue>
 387                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 388                         </Match>
 389                     </AllOf>
 390                 </AnyOf>
 391             </Target>
 392         </Rule>
 393         <Rule RuleId="urn:com:att:xacml:rule:id:e4541019-4503-490f-97e0-b94251fdc629" Effect="Permit">
 394             <Description>PERMIT - super editor can read</Description>
 395             <Target>
 396                 <AnyOf>
 397                     <AllOf>
 398                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 399                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
 400                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 401                         </Match>
 402                     </AllOf>
 403                 </AnyOf>
 404             </Target>
 405         </Rule>
 406         <Rule RuleId="urn:com:att:xacml:rule:id:80422fdf-5094-4609-925e-289ad226e2aa" Effect="Deny">
 407             <Description>DENY - default</Description>
 408             <Target/>
 409         </Rule>
 410     </Policy>
 411     <Policy PolicyId="urn:com:att:xacml:policy:id:980c728d-fb53-4f2f-ba5f-823e594302eb" Version="1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
 412         <Description>Guest policy</Description>
 413         <Target>
 414             <AnyOf>
 415                 <AllOf>
 416                     <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 417                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">guest</AttributeValue>
 418                         <AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 419                     </Match>
 420                 </AllOf>
 421             </AnyOf>
 422         </Target>
 423         <Rule RuleId="urn:com:att:xacml:rule:id:07e4ea58-b2b7-41e4-a600-ebd5fb1c3144" Effect="Permit">
 424             <Description>PERMIT - application access.</Description>
 425             <Target>
 426                 <AnyOf>
 427                     <AllOf>
 428                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 429                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">access</AttributeValue>
 430                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 431                         </Match>
 432                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 433                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">application</AttributeValue>
 434                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 435                         </Match>
 436                     </AllOf>
 437                 </AnyOf>
 438             </Target>
 439         </Rule>
 440         <Rule RuleId="urn:com:att:xacml:rule:id:e4541019-4503-490f-97e0-b94251fdc629" Effect="Permit">
 441             <Description>PERMIT - guest can access</Description>
 442             <Target>
 443                 <AnyOf>
 444                     <AllOf>
 445                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 446                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">access</AttributeValue>
 447                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 448                         </Match>
 449                     </AllOf>
 450                 </AnyOf>
 451             </Target>
 452         </Rule>
 453                 <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b67-a23e-f475c41f2d12s" Effect="Permit">
 454             <Description>PERMIT - guest to access pdp</Description>
 455             <Target>
 456                 <AnyOf>
 457                     <AllOf>
 458                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 459                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">pdp_admin</AttributeValue>
 460                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 461                         </Match>
 462                     </AllOf>
 463                 </AnyOf>
 464             </Target>
 465         </Rule>
 466         <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b68-a23e-f475c41f2d11" Effect="Permit">
 467             <Description>PERMIT - any action on the policymanagement</Description>
 468             <Target>
 469                 <AnyOf>
 470                     <AllOf>
 471                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 472                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">application</AttributeValue>
 473                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 474                         </Match>
 475                     </AllOf>
 476                 </AnyOf>
 477             </Target>
 478         </Rule>
 479         <Rule RuleId="urn:com:att:xacml:rule:id:80004328-a1fc-4238-b2a8-906f6b8ae572" Effect="Deny">
 480             <Description>DENY - default</Description>
 481             <Target/>
 482         </Rule>
 483     </Policy>
 484        <Policy PolicyId="urn:com:att:xacml:policy:id:980c728d-fb53-4f2f-ba5f-823e594302eb" Version="1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
 485         <Description>super guest policy</Description>
 486         <Target>
 487             <AnyOf>
 488                 <AllOf>
 489                     <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 490                         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">super-guest</AttributeValue>
 491                         <AttributeDesignator Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 492                     </Match>
 493                 </AllOf>
 494             </AnyOf>
 495         </Target>
 496         <Rule RuleId="urn:com:att:xacml:rule:id:07e4ea58-b2b7-41e4-a600-ebd5fb1c3144" Effect="Permit">
 497             <Description>PERMIT - application access.</Description>
 498             <Target>
 499                 <AnyOf>
 500                     <AllOf>
 501                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 502                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">access</AttributeValue>
 503                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 504                         </Match>
 505                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 506                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">application</AttributeValue>
 507                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 508                         </Match>
 509                     </AllOf>
 510                 </AnyOf>
 511             </Target>
 512         </Rule>
 513         <Rule RuleId="urn:com:att:xacml:rule:id:e4541019-4503-490f-97e0-b94251fdc629" Effect="Permit">
 514             <Description>PERMIT - super guest can access</Description>
 515             <Target>
 516                 <AnyOf>
 517                     <AllOf>
 518                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 519                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">access</AttributeValue>
 520                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 521                         </Match>
 522                     </AllOf>
 523                 </AnyOf>
 524             </Target>
 525         </Rule>
 526                 <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b67-a23e-f475c41f2d12s" Effect="Permit">
 527             <Description>PERMIT - super guest to access pdp</Description>
 528             <Target>
 529                 <AnyOf>
 530                     <AllOf>
 531                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 532                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">pdp_admin</AttributeValue>
 533                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 534                         </Match>
 535                     </AllOf>
 536                 </AnyOf>
 537             </Target>
 538         </Rule>
 539         <Rule RuleId="urn:com:att:xacml:rule:id:da1cf042-5949-4b68-a23e-f475c41f2d11" Effect="Permit">
 540             <Description>PERMIT - any action on the dictionaries</Description>
 541             <Target>
 542                 <AnyOf>
 543                     <AllOf>
 544                         <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
 545                             <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">application</AttributeValue>
 546                             <AttributeDesignator Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
 547                         </Match>
 548                     </AllOf>
 549                 </AnyOf>
 550             </Target>
 551         </Rule>
 552         <Rule RuleId="urn:com:att:xacml:rule:id:80004328-a1fc-4238-b2a8-906f6b8ae572" Effect="Deny">
 553             <Description>DENY - default</Description>
 554             <Target/>
 555         </Rule>
 556     </Policy>
 557     <Policy PolicyId="urn:com:att:xacml:policy:id:54702055-e0ce-456b-854b-ffab1ff0c7e9" Version="1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
 558         <Description>Unknown user id</Description>
 559         <Target/>
 560         <Rule RuleId="urn:com:att:xacml:rule:id:5b6029cf-5c33-4948-8dc9-fd758f85db29" Effect="Deny">
 561             <Description>DENY</Description>
 562             <Target/>
 563         </Rule>
 564     </Policy>
 565 </PolicySet>