Changeset 5005

Timestamp:

20/02/09 16:10:34 (12 years ago)

Author:

pjkersha

Message:

More work on Policy and Effect classes

File:

• TI12-security/trunk/python/ndg.security.common/ndg/security/common/authz/pdp/xacml.py (modified) (4 diffs)

TI12-security/trunk/python/ndg.security.common/ndg/security/common/authz/pdp/xacml.py

@@ -15 +15 @@
 
 from ndg.security.common.authz.pdp import PDPInterface
-
+        
 class Subject(object):
     '''XACML Subject designator'''
@@ -25 +25 @@
     '''XACML Action designator'''
 
-class Environment(dict):
+class Environment(object):
     '''XACML Environment designator'''
+
+class Policy(object):
+    def __init__(self):
+        self.description = None
+        self.rules = []
+        self.algID = None
+        self.obligations = []
+        self.target = None
+
+    def encode(self):
+        '''Encode the policy'''
+        raise NotImplemented()
     
+class Target(object):
+    def __init__(self):
+        self.subject = Subject()
+        self.resource = Resource()
+        self.action = Action()
+
+   
+class Effect(object):
+    def __str__(self):
+        raise NotImplementedError()
+       
+class DenyEffect(object):
+    def __str__(self):
+        return 'deny'
+        
+class PermitEffect(object):
+    def __str__(self):
+        return 'permit'
+
+class Rule(object):
+    '''Consists of a condition, an effect, and a target.
+    '''
+    def __init__(self):
+        # Conditions are statements about attributes that upon evaluation 
+        # return either True, False, or Indeterminate.
+        self.conditions = []
+        # Effect is the intended consequence of the satisfied rule. It can 
+        # either take the value Permit or Deny.
+        self.effect = DenyEffect()
+        
+        # Target, as in the case of a policy, helps in determining whether or 
+        # not a rule is relevant for a request. The mechanism for achieving 
+        # this is also similar to how it is done in the case of a target for a 
+        # policy.
+        self.target = Target()
+        
+       
 class Request(object):
     '''XACML Request object
@@ -43 +92 @@
     
     This is an initial iteration toward a complete XACML implementation'''
-    def accessPermitted(self, subject, resource, action, environ):
+    def __init__(self, *arg, **kw):
+        pass
+    
+    def accessPermitted(self, subject, resource, action, environment):
         '''Make access control decision - override this in a derived class to
         implement the decision logic but this method may be called within
@@ -72 +124 @@
         # Default to denied
         return False
-    
-    __call__ = accessPermitted