source: TI12-security/trunk/NDG_XACML/ndg/xacml/test/rule2.xml @ 7064

<?xml version="1.0" encoding="UTF-8"?>
<Policy xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os" 
    xmlns:xacml-context="urn:oasis:names:tc:xacml:2.0:context:schema:os" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:policy:schema:os http://docs.oasis-open.org/xacml/access_control-xacml-2.0-policy-schema-os.xsd" 
    xmlns:xf="http://www.w3.org/TR/2002/WD-xquery-operators-20020816/#" 
    xmlns:md="http:www.med.example.com/schemas/record.xsd" 
    PolicyId="urn:oasis:names:tc:xacml:2.0:example:policyid:2" 
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides">

    <PolicyDefaults>
        <XPathVersion>http://www.w3.org/TR/1999/Rec-xpath-19991116</XPathVersion>
    </PolicyDefaults>

    <Target/>
<!-- VariableDefinition is not currently implemented 29/03/10
    <VariableDefinition VariableId="17590035">
        <Apply FunctionId="urn:oasis:names:tc:xacml:2.0:function:date-less-or-equal">
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:date-one-and-only">
                <EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-date" DataType="http://www.w3.org/2001/XMLSchema#date"/>
            </Apply>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:date-add-yearMonthDuration">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:date-one-and-only">
                    <AttributeSelector RequestContextPath="//xacml-context:Resource/xacml-context:ResourceContent/md:record/md:patient/md:patientDoB/text()" DataType="http://www.w3.org/2001/XMLSchema#date"/>
                </Apply>
                <AttributeValue DataType="http://www.w3.org/TR/2002/WD-xquery-operators-20020816#yearMonthDuration">
                    <xf:dt-yearMonthDuration>
                        P16Y
                    </xf:dt-yearMonthDuration>
                </AttributeValue>
            </Apply>
        </Apply>
    </VariableDefinition>
   -->
    <Rule RuleId="urn:oasis:names:tc:xacml:2.0:example:ruleid:2" Effect="Permit">
        <Description>
            A person may read any medical record in the
            http://www.med.example.com/records.xsd namespace
            for which he or she is the designated parent or guardian, 
            and for which the patient is under 16 years of age
        </Description>
        <Target>
            <Resources>
                <Resource>
                    <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:med:example:schemas:record</AttributeValue>
                        <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:resource:target-namespace" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    </ResourceMatch>
                    <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:xpath-node-match">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">/md:record</AttributeValue>
                        <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:xpath" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    </ResourceMatch>
                </Resource>
            </Resources>
            <Actions>
                <Action>
                    <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                        <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    </ActionMatch>
                </Action>
            </Actions>
        </Target>
        <Condition>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <SubjectAttributeDesignator 
                         AttributeId="urn:oasis:names:tc:xacml:2.0:example:attribute:parent-guardian-id" 
                         DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    </Apply>
                    <Apply 
                     FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeSelector 
                         RequestContextPath="//md:record/md:parentGuardian/md:parentGuardianId/text()" 
                         DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    </Apply>
                </Apply>
                <!-- 
                <VariableReference VariableId="17590035"/>
                -->
            </Apply>
        </Condition>
    </Rule>
</Policy>