openaz-xacml-test/testsets/conformance/xacml3.0-ct-v.0.4/IID014Policy.xml

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<PolicySet xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:permit-overrides" PolicySetId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID014:policyset" Version="1.0" xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:policy:schema:os access_control-xacml-2.0-policy-schema-os.xsd">
    <Description>
        PolicySet for Conformance Test IID014.
    </Description>
    <Target/>
    <Policy PolicyId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID014:policy1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:permit-overrides" Version="1.0">
        <Description>
            Policy1 for Conformance Test IID014.
         Purpose: Case: Deny: PolicyCombiningAlgorithm PermitOverrides
        </Description>
        <Target/>
        <Rule Effect="Deny" RuleId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID014:rule1">
            <Description>
                A subject whose name is J. Hibbert may not
                read Bart Simpson's medical record.  NOTAPPLICABLE
            </Description>
            <Target>
                <AnyOf>
                    <AllOf>
                        <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">J. Hibbert</AttributeValue>
                            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                        </Match>
                    </AllOf>
                </AnyOf>
            </Target>
        </Rule>
    </Policy>
    <Policy PolicyId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID014:policy2" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:permit-overrides" Version="1.0">
        <Description>
            Policy2 for Conformance Test IID014.
        </Description>
        <Target/>
        <Rule Effect="Permit" RuleId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID014:rule2">
            <Description>
                A subject who is at least 100 years older than Bart
                Simpson may perform any action on any resource.
                record. NOT APPLICABLE.
            </Description>
            <Condition>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-greater-than-or-equal">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-subtract">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:conformance-test:age" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#integer" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:conformance-test:bart-simpson-age" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#integer" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#integer">100</AttributeValue>
</Apply>
            </Condition>
        </Rule>
    </Policy>
    <Policy PolicyId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID014:policy4" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:permit-overrides" Version="1.0">
        <Description>
            Policy4 for Conformance Test IID014.
        </Description>
        <Target/>
        <Rule Effect="Deny" RuleId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID014:rule4">
            <Description>
                A subject whose name is Julius Hibbert may not
                perform any action on any resource.  DENY.
            </Description>
            <Condition>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                </Apply>
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Julius Hibbert</AttributeValue>
</Apply>
            </Condition>
        </Rule>
    </Policy>
</PolicySet>