Evaluating multi-valued Attribute in XACML 2.0 policy

Question

How can I evaluate multi-valued attributes in XACML 2.0? I have the following XACML 2.0 policy and request. The user gets a permit if he is in the role of super-admin. Having multiple roles as <AttributeValue> elements within the same subject-attribute, only the first <AttributeValue> element is retrieved for evaluation. How can I fetch and check all of those values in my policy?

The Policy

<Policy xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os"  PolicyId="a-user-role-policy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
   <Description>Sample XACML Authorization Policy</Description>
   <Target></Target>
   <Rule Effect="Permit" RuleId="primary-group-rule">
      <Target>
         <Actions>
            <Action>
               <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                  <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"></ActionAttributeDesignator>
               </ActionMatch>
            </Action>
         </Actions>
      </Target>
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
            <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"></Function>
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">super-admin</AttributeValue>
            <SubjectAttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string"></SubjectAttributeDesignator>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="deny-rule"></Rule>
</Policy>

The Request

<Request xmlns="urn:oasis:names:tc:xacml:2.0:context:schema:os"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <Subject>
        <Attribute AttributeId="group"
            DataType="http://www.w3.org/2001/XMLSchema#string">
            <AttributeValue>admin</AttributeValue>
            <AttributeValue>super-admin</AttributeValue>
        </Attribute>
    </Subject>
    <Resource>
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
            DataType="http://www.w3.org/2001/XMLSchema#string">
            <AttributeValue>http://localhost:8280/services/echo/</AttributeValue>
        </Attribute>
    </Resource>
    <Action>
        <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
            DataType="http://www.w3.org/2001/XMLSchema#string">
            <AttributeValue>read</AttributeValue>
        </Attribute>
    </Action>
    <Environment />
</Request>

You should switch to AuthZForce (open-source) or Axiomatics (commercial) — David Brossard
It works fine, when I split the <AttributeValue> list into separate <Attribute> elements, each of them having a single <AttributeValue>. — user098

David Brossard David Brossard · Accepted Answer · 2019-03-20T15:08:01

By design, in XACML, attributes are always considered multi-valued. They're what we call bags. The attribute values do not have an order. This means that:

Example 1: role = ["manager"]
Example 2: role = ["manager" , "janitor"]
Example 3: role = ["janitor", "manager"]
Example 4: role = ["janitor", "manager", "manager"]

are all valid values for attribute role. Note that even a single-valued attribute is still a bag of values. Examples 2 and 3 are the same given order does not matter in bags. Lastly, values can be repeated in a bag. I cannot think of a good reason why but technically they can (as in example 4).

If, for some reason, the PDP you are using only considers the first value, then it has a major bug in its implementation.

Evaluating multi-valued Attribute in XACML 2.0 policy

The Policy

The Request

1 Answers