openaz-xacml-test/testsets/conformance/xacml3.0-ct-v.0.4/xacml3.0-deprecated/IID308dPolicy.xml

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<PolicySet xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" 
		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
		PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.1:policy-combining-algorithm:ordered-deny-overrides" 
		PolicySetId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308d1:policyset" 
		Version="1.0" 
		xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:policy:schema:os access_control-xacml-2.0-policy-schema-os.xsd">
    <Description>
        PolicySet for Conformance Test IID308d1.
        Purpose: Case: Deny: PolicyCombiningAlgorithm Ordered DenyOverrides
        In conjunction with IID307 this demonstrates that the first Policy in this file that returns Deny is the one used.
    </Description>
    <Target/>
    
    <Policy PolicyId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:policy1" 
    		RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.1:rule-combining-algorithm:ordered-deny-overrides" 
    		Version="1.0">
        <Description>
            Policy1 for Conformance Test IID308d1.
        </Description>
        <Target/>
        <Rule Effect="Deny" RuleId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:rule1">
            <Description>
                A subject whose name is J. Hibbert may not
                read Bart Simpson's medical record.  NOTAPPLICABLE
            </Description>
            <Target>
                <AnyOf>
                    <AllOf>
                        <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">J. Hibbert</AttributeValue>
                            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
                        </Match>
                    </AllOf>
                </AnyOf>
            </Target>
        </Rule>
    </Policy>
    
    <Policy PolicyId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:policy2" 
    		RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.1:rule-combining-algorithm:ordered-deny-overrides" 
    		Version="1.0">
        <Description>
            Policy2 for Conformance Test IID308d1.
        </Description>
        <Target/>
        <Rule Effect="Permit" RuleId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID006:rule2">
            <Description>
                A subject who is at least 5 years older than Bart
                Simpson may read Bart Simpson's medical record. PERMIT.
            </Description>
            <Condition>
			  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-greater-than-or-equal">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-subtract">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:conformance-test:age" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#integer" MustBePresent="true"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:conformance-test:bart-simpson-age" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType="http://www.w3.org/2001/XMLSchema#integer" MustBePresent="true"/>
                    </Apply>
                </Apply>
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#integer">5</AttributeValue>
			  </Apply>
            </Condition>
        </Rule>
    </Policy>
    
    
	<!--  Order (position in this file) of this policy is different than in IID308 - this one comes first, so its Obligations should be seen in Response -->
    <Policy PolicyId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:policy5" 
    		RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.1:rule-combining-algorithm:ordered-deny-overrides" Version="1.0">
        <Description>
            Policy5 for Conformance Test IID308d1.
        </Description>
        <Target/>
        <Rule Effect="Deny" RuleId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:rule5">
            <Description>
                A subject whose name is Julius Hibbert may not
                perform any action on any resource.  DENY.
            </Description>
            <Condition>
			  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
                </Apply>
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Julius Hibbert</AttributeValue>
			  </Apply>
            </Condition>
        </Rule>
        <ObligationExpressions>
	        <ObligationExpression FulfillOn="Deny" ObligationId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:obligation-2">
	            <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:assignment2">
	                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">assignment2</AttributeValue>
	            </AttributeAssignmentExpression>
	        </ObligationExpression>
        </ObligationExpressions>
    </Policy>
    
    
    
    <Policy PolicyId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:policy3" 
    		RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.1:rule-combining-algorithm:ordered-deny-overrides" 
    		Version="1.0">
        <Description>
            Policy3 for Conformance Test IID308d1.
        </Description>
        <Target/>
        <Rule Effect="Permit" RuleId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:rule3">
            <Description>
                A subject whose "bogus" attribute is "Zaphod Beeblebrox"
                may perform any action on any resource.  INDETERMINATE.
            </Description>
            <Target>
                <AnyOf>
                    <AllOf>
                        <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Zaphod Beeblebrox</AttributeValue>
                            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:conformance-tests:bogus" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
                        </Match>
                    </AllOf>
                </AnyOf>
            </Target>
        </Rule>
    </Policy>
    
    <Policy PolicyId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:policy4" 
    		RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.1:rule-combining-algorithm:ordered-deny-overrides" Version="1.0">
        <Description>
            Policy4 for Conformance Test IID308d1.
        </Description>
        <Target/>
        <Rule Effect="Deny" RuleId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:rule4">
            <Description>
                A subject whose name is Julius Hibbert may not
                perform any action on any resource.  DENY.
            </Description>
            <Condition>
			  <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
                </Apply>
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Julius Hibbert</AttributeValue>
			  </Apply>
            </Condition>
        </Rule>
            <ObligationExpressions>
		        <ObligationExpression FulfillOn="Deny" ObligationId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:obligation-1">
		            <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:2.0:conformance-test:IID308:assignment1">
		                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">assignment1</AttributeValue>
		            </AttributeAssignmentExpression>
		        </ObligationExpression>
        </ObligationExpressions>
    </Policy>
    

    
</PolicySet>