{"history":[],"article":{"id":"216c3779-5802-403b-be05-668db912bf15","title":"XACML","slug":"xacml","content":":::summary\n**Name:** XACML \n**Paradigm:** [Declarative programming](https://bliptext.com/articles/declarative-programming) \n**Year:** April 16, 2001 \n**Developer:** [Organization for the Advancement of Structured Information Standards (OASIS)](https://bliptext.com/articles/oasis-organization) \n**Implementations:** Axiomatics, AuthzForce \n**Influenced By:** [XML](https://bliptext.com/articles/xml), [SAML](https://bliptext.com/articles/saml) \n**Influenced:** [ALFA (XACML)](https://bliptext.com/articles/alfa-xacml) \n**Dialects:** [ALFA (XACML)](https://bliptext.com/articles/alfa-xacml) \n**License:** [OASIS](https://bliptext.com/articles/undefined) \n**Website:** https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml \n**File Ext:** .xml, .alfa \n:::\n\n# \nThe **eXtensible Access Control Markup Language** (**XACML**) is an [XML](https://bliptext.com/articles/xml)-based standard [markup language](https://bliptext.com/articles/markup-language) for specifying [access control](https://bliptext.com/articles/access-control) policies.\nThe standard, published by [OASIS](https://bliptext.com/articles/oasis-organization), defines a declarative fine-grained, attribute-based [access control](https://bliptext.com/articles/access-control) policy language, an architecture, and a processing model describing how to evaluate access requests according to the rules defined in policies.\nXACML is primarily an [attribute-based access control](https://bliptext.com/articles/attribute-based-access-control) system.\nIn XACML, attributes – information about the subject accessing a resource, the resource to be addressed, and the environment – act as inputs for the decision of whether access is granted or not.\nXACML can also be used to implement [role-based access control](https://bliptext.com/articles/role-based-access-control).\nIn XACML, access control decisions to be taken are expressed as Rules.\nEach Rule comprises a series of conditions which decide whether a given request is approved or not.\nIf a Rule is applicable to a request but the conditions within the Rule fail to evaluate, the result is Indeterminate.\nRules are grouped together in Policies, and a PolicySet contains Policies and possibly other PolicySets.\nEach of these also includes a Target, a simple condition that determines whether it should be evaluated for a given request.\nCombining algorithms can be used to combine Rules and Policies with potentially differing results in various ways.\nXACML also supports obligations and advice expressions.\nObligations specify actions which must be executed during the processing of a request, for example for logging.\nAdvice expressions are similar, but may be ignored.\nXACML separates access control functionality into several components.\nEach operating environment in which access control is used has a Policy Enforcement Point (PEP) which implements the functionality to demand authorization and to grant or deny access to resources.\nThese refer to an environment-independent and central Policy Decision Point (PDP) which actually makes the decision on whether access is granted.\nThe PDP refers to policies stored in the Policy Retrieval Point (PRP).\nPolicies are managed through a Policy Administration Point (PAP).\nVersion 3.0 was ratified by OASIS in January 2013.\n\n# History\nVersion 1.0 was ratified by [OASIS](https://bliptext.com/articles/oasis-organization) [standards organization](https://bliptext.com/articles/standards-organization) in 2003.\nVersion 2.0 was ratified by OASIS standards organization on February 1, 2005.\nVersion 3.0 was ratified by OASIS in January 2013.\n\n# Architecture\n\n## Terminology\nNon-normative terminology (following RFC 2904, except for PAP)\n\n## Flow\n# [This image shows the XACML architecture and a sample authorization flow. | upload.wikimedia.org/wikipedia/commons/f/f2/XACML///Architecture///%26///Flow.png]\n\n# Policy elements\n\n## Structural elements\nXACML is structured into 3 levels of elements:\nA policy set can contain any number of policy elements and policy set elements.\nA policy can contain any number of rule elements.\n\n## Attributes and categories\nPolicies, policy sets, rules and requests all use subjects, resources, environments, and actions.\n\n## Targets\nXACML provides a target, which is basically a set of simplified conditions for the subject, resource, and action that must be met for a policy set, policy, or rule to apply to a given request.\nOnce a policy or policy set is found to apply to a given request, its rules are evaluated to determine the access decision and response.\nIn addition to being a way to check applicability, target information also provides a way to index policies, which is useful if you need to store many policies and then quickly sift through them to find which ones apply.\nWhen a request to access that service arrives, the PDP will know where to look for policies that might apply to this request because the policies are indexed based on their target constraints.\nNote that a target may also specify that it applies to any request.\nPolicy set, policy and rule can all contain target elements.\n\n## Conditions\nConditions only exist in rules.\nConditions are essentially an advanced form of a target which can use a broader range of functions and more importantly can be used to compare two or more attributes together, e.g. subject-id==doctor-id.\nWith conditions, it is possible to implement segregation of duty checks or relationship-based access control.\n\n## Obligations & Advice\nWithin XACML, a concept called obligations can be used.\nAn obligation is a directive from the policy decision point (PDP) to the policy enforcement point (PEP) on what must be carried out before or after an access is approved.\nIf the PEP is unable to comply with the directive, the approved access may or must not be realized.\nThe augmentation of obligations eliminates a gap between formal requirements and policy enforcement.\nAn example of an obligation could look like this:\nAccess control rule:\nAllow access to resource MedicalJournal with attribute patientID=x\nif Subject match DesignatedDoctorOfPatient\nand action is read\nwith obligation\non Permit: doLog_Inform(patientID, Subject, time)\non Deny : doLog_UnauthorizedLogin(patientID, Subject, time)\nThe XACML's obligation can be an effective way to meet formal requirements (non-repudiation for example) that can be hard to implement as access control rules.\nFurthermore, any formal requirements will be part of the access control policy as obligations and not as separate functions, which makes policies consistent and centralization of the IT environment easier to achieve.\nObligations can be used for \"break-the-glass\" scenarios or trust elevation (\"you cannot transfer $1,000 without two-factor authentication - here is the link to the 2FA page\").\nIn addition to obligations, XACML supports advice which are identical to obligations with the difference that a PEP is not obligated to enforce the advice (hence its name).\n\n# Combining algorithms\nWhat happens in XACML if there are two rules (or policies) that contradict each other?\nImagine for instance a first rule that would say managers can view documents and a second rule that would say no one can work before 9am.\nWhat if the request is about Alice trying to view a document at 8am?\nWhich rule wins?\nThis is what combining algorithms tell us.\nThey help resolve conflicts.\nXACML defines a number of combining algorithms that can be identified by a RuleCombiningAlgId or PolicyCombiningAlgId attribute of the or elements, respectively.\nThe rule-combining algorithm defines a procedure for arriving at an access decision given the individual results of evaluation of a set of rules.\nSimilarly, the policy-combining algorithm defines a procedure for arriving at an access decision given the individual results of evaluation of a set of policies.\n\n# Functions\nXACML defines a long list of functions (close to 300) to manipulate and compare attributes to other attributes and values:\nThe functions and their identifiers are fully described in the standard.\nFunctions are type-specific i.e. there is a function for string equality and a different one for integer equality.\n\n## Equality, inequality and other matching functions\n\n## Arithmetic functions\nRefer to the standard for a formal definition of these function.\n\n## String functions\nRefer to the standard for a formal definition of these function.\n\n## Logical functions (and, or, not)\n\n## Set and bag functions\n\n## Regular expression functions\n\n## XPath functions\n\n## Higher order functions\nThe list of higher order functions is as listed below.\nFor a formal definition, refer to the XACML standard.\n\n# XACML 3.0\n\n## Schema\nhttp://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd\n\n## Data types\n\n## New in XACML 3.0\n\n### New profiles\nXACML 3.0 introduces administrative delegation, the JSON Profile of XACML (request/response), the REST Profile of XACML, the Multiple Decision Profile of XACML, and many more.\n\n#### Delegation\nThe implementation of delegation is new in XACML 3.0.\nThe delegation mechanism is used to support decentralized administration of access policies.\nIt allows an authority (delegator) to delegate all or parts of its own authority or someone else's authority to another user (delegate) without any need to involve modification of the root policy.\nThis is because, in this delegation model, the delegation rights are separated from the access rights.\nThese are instead referred to as administrative control policies.\nAccess control and administrative policies work together as in the following scenario:\nA partnership of companies' many services are protected by an access control system.\nThe system implements the following central rules to protect its resources and to allow delegation:\nAccess control rules:\nAllow access\nto resource with attribute WebService\nif subject is Employee and action is read or write.\nAdministration control rules:\nAllow delegation of access control rule #1\nto subjects with attribute Consultant.\nConditions:\ndelegation must expire within 6 months,\nresource must not have attribute StrictlyInternal.\n(Attributes can be fetched from an external source, e.g. a LDAP catalog.)\nWhen a consultant enters the corporation, a delegation can be issued locally by the consultant's supervisor, authorizing the consultant access to systems directly.\nThe delegator (the supervisor in this scenario) may only have the right to delegate a limited set of access rights to consultants.\n\n### Other features\nOther new features of XACML 3.0 are listed at http://www.webfarmr.eu/2010/07/enhancements-and-new-features-in-xacml-3-axiomatics/\nThe XACML TC is also publishing a list of changes here: http://wiki.oasis-open.org/xacml/DifferencesBetweenXACML2.0AndXACML3.0\n\n# Sample policies\n\n## Date and time-based authorization in XACML\nThis rule implements the use-it-lose-it access control paradigm.\nIf a user does not log in for 30 days, then they lose access.\nIn pseudo-code: deny if currentDateTime > lastLogin + 30 days\n\nUse it or lose it: this policy denies access if lastLogin is more than 30 days away from today's date\n\n\n\n\n\n\n\n\nP30D\n\n\n\n\n\n\n## Time-based authorization in XACML\nThis rule grants access if the current time is greater than 9am and less than 5pm.\n\nAllow if time between 9 and 5\n\n\n\n\n09:00:00\n\n\n\n\n\n\n\n17:00:00\n\n\n\n\n\n\n\n# Sample requests and responses\n\n## XACML 3.0 request\n\n\n\nview\n\n\n\n\ndoc#123\n\n\n\n\nAlice\n\n\n\n\n## XACML 3.0 responses\n\n### XACML 3.0 sample response\n****\n****\n****NotApplicable****\n****\n****\n****\n****\n****\n\n### XACML 3.0 sample response with obligation\nThe following contains an Obligation block.\nObligations are statements that can be returned along with a decision to enrich the decision flow.\nIn this example, the PEP must log that access was granted.\n\n\nPermit\n\n\n\n\n\n\n\n\n http://www.axiomatics.com/automatic-unique-id/18a9eae9-c92b-4087-b2ac-c5a33d7ff477 \n\n\n\n\n# The Multiple Decision Profile of XACML 3.0\nBy default a PDP processes a single request at a time e.g. \"Can Alice view item #1?\".\nThe PDP then replies with a single decision.\nAt times, though, it is necessary to send multiple requests in one go e.g. \"Can Alice view / edit / delete items #1, #2, #3?\".\nThe Multiple Decision Profile of XACML allows for this use case.\nThe PDP will typically do the product of all combinations i.e. in the example aforementioned there will be 1 x 3 x 3 = 9 decisions returned in a single response.\n\n## Sample JSON Request for the Multiple Decision Profile\nThe way to enable the MDP is to send an array of objects for any of the categories rather than an array of one object (or simply an object).\nFor instance, AccessSubject is an object but Resource is an array of objects.\nThe latter will trigger the MDP process in PDPs that support the profile.\nNote as well the use of the IncludeInResult attribute which tells the PDP to return the XACML attribute and its value in the response so that decisions can be correlated to the relevant attribute values.\n{ **\"Request\"**: {\n**\"ReturnPolicyIdList\"**: **true**,\n**\"AccessSubject\"**: {\n**\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.user.username\",\n**\"Value\"**: \"Alice\"\n}] }, **\"Resource\"**: [{\n**\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.objectType\",\n**\"Value\"**: \"record\"\n}, { **\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"123\",\n**\"IncludeInResult\"**: **true**\n}] },{ **\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.objectType\",\n**\"Value\"**: \"record\"\n}, { **\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"124\",\n**\"IncludeInResult\"**: **true**\n}] },{ **\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.objectType\",\n**\"Value\"**: \"record\"\n}, { **\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"125\",\n**\"IncludeInResult\"**: **true**\n}] }], **\"Action\"**: [{\n**\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"view\",\n**\"IncludeInResult\"**: **true**\n}] },{ **\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"edit\",\n**\"IncludeInResult\"**: **true**\n}] },{ **\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"delete\",\n**\"IncludeInResult\"**: **true**\n}] }] } }\n\n## Sample JSON Response for the Multiple Decision Profile\n{ **\"Response\"**: [\n{ **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"3\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"125\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"view\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"2\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"124\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"view\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"123\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"edit\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: {\n**\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n}, **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"123\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"delete\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: {\n**\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n}, **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"3\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"125\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"delete\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"3\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"125\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"edit\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"2\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"124\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"delete\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"123\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"view\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: {\n**\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n}, **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"2\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"124\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"edit\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } } ] }\n\n# Developer orientation\nIn 2013 and 2014, the XACML Technical Committee focused on designing new profiles to facilitate developer integration.\nThese include:\nAll three profiles were showcased at the Cloud Identity Summit 2014 in Monterey, California.\nUsing these profiles, integrating fine-grained authorization into applications becomes much easier.\n\n## The ALFA Profile of XACML\nALFA stands for Abbreviated Language for Authorization.\nIt is a lightweight syntax used to implement policy-based access control policies.\nFor examples refer to the [main article](https://bliptext.com/articles/alfa-xacml).\n\n## The JSON Profile of XACML\nThe JSON profile of XACML simplifies the integration between the PEP and the PDP.\n\n### Sample JSON request\n{ **\"Request\"**: {\n**\"AccessSubject\"**: {\n**\"Attribute\"**: [\n{ **\"AttributeId\"**: \"com.acme.user.employeeId\",\n**\"Value\"**: \"Alice\"\n} ] }, **\"Resource\"**: {\n**\"Attribute\"**: [\n{ **\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"123\"\n}, { **\"AttributeId\"**: \"com.acme.object.objectType\",\n**\"Value\"**: \"record\"\n} ] }, **\"Action\"**: {\n**\"Attribute\"**: [\n{ **\"AttributeId\"**: \"com.acme.action.actionId\",\n**\"Value\"**: \"view\"\n} ] }, **\"Environment\"**: {\n**\"Attribute\"**: []\n} } }\n\n## Sample JSON response\n{ **\"Response\"** : {\n**\"Decision\"** : \"Permit\",\n**\"Status\"** : {\n**\"StatusCode\"** : {\n**\"Value\"** : \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} } } }\n\n# XACML and other standards\n\n## XACML and Open Policy Agent\nXACML is almost entirely a **policy definition language** based on [XML](https://bliptext.com/articles/xml) and [XSLT](https://bliptext.com/articles/xslt), defined by an open [OASIS](https://bliptext.com/articles/oasis-organization) specification.\nThe XACML specification does not cover the design or implementation of Policy Decision Point (PDP), only the policy language they consume.\nMany [proprietary](https://bliptext.com/articles/proprietary-software) and [open-source](https://bliptext.com/articles/open-source-software) PDPs use XACML as their policy definition language.\nOpen Policy Agent (OPA) is an open-source Policy Decision Point (PDP) implementation, capable of interpreting policy language to render policy decisions.\nOPA is a general-purpose PDP implementation which can be used for any scenario where a policy decision is required, much like PDP implementations that support the XACML specification.\nOPA's policy definition language is (Rego), which is a JSON-based, Turing-incomplete language based on Datalog.\nPolicies written in XACML can be translated to Rego, and vice-versa.\n\n## XACML and SAML\n[SAML](https://bliptext.com/articles/security-assertion-markup-language) is an identity SSO and federation standard used for authentication.\nSAML is used as a common identity token format between different applications.\nSAML and XACML are both defined by [OASIS](https://bliptext.com/articles/oasis-organization).\nSAML and XACML were designed to interoperate where SAML is used to carry identity information / virtual identities and XACML is used to drive the access control logic through policies.\n# [Example of cross-enterprise federation where two enterprises federate using SAML and two Security Token Services (STS), establishing a circle of trust. The SAML in this picture is used for identity exchange / virtualization. The XACML is used server-side to determine whether access should be granted to the application functionality (functional access control) and the data behind it (data access control). | upload.wikimedia.org/wikipedia/commons/5/55/Cross-Enterprise///Federation///using///SAML///and///XACML.png]\n\n## XACML and OAuth\n[OAuth 2.0](https://bliptext.com/articles/oauth) is considered to be an authorization standard.\nIt differs from XACML though in its origin, its purpose, and its applications.\nOAuth is about:\nXACML does not handle user approval or delegated access or password management.\nXACML simply provides:\nXACML and OAuth can be combined to deliver a more comprehensive approach to authorization.","current_revision":null,"created_by":"kACnuQmH5k9Nr5VNVEpVeg7XpvUmMctD","created_at":"2025-01-25T21:56:49.949Z","updated_at":"2025-01-25T21:56:49.949Z","search_vector":"'xacml':1","search_content":" \n**Name:** XACML \n**Paradigm:** [Declarative programming](https://bliptext.com/articles/declarative-programming) \n**Year:** April 16, 2001 \n**Developer:** [Organization for the Advancement of Structured Information Standards (OASIS)](https://bliptext.com/articles/oasis-organization) \n**Implementations:** Axiomatics, AuthzForce \n**Influenced By:** [XML](https://bliptext.com/articles/xml), [SAML](https://bliptext.com/articles/saml) \n**Influenced:** [ALFA (XACML)](https://bliptext.com/articles/alfa-xacml) \n**Dialects:** [ALFA (XACML)](https://bliptext.com/articles/alfa-xacml) \n**License:** [OASIS](https://bliptext.com/articles/undefined) \n**Website:** https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml \n**File Ext:** .xml, .alfa \n \n\n# \nThe **eXtensible Access Control Markup Language** (**XACML**) is an [XML](https://bliptext.com/articles/xml)-based standard [markup language](https://bliptext.com/articles/markup-language) for specifying [access control](https://bliptext.com/articles/access-control) policies.\nThe standard, published by [OASIS](https://bliptext.com/articles/oasis-organization), defines a declarative fine-grained, attribute-based [access control](https://bliptext.com/articles/access-control) policy language, an architecture, and a processing model describing how to evaluate access requests according to the rules defined in policies.\nXACML is primarily an [attribute-based access control](https://bliptext.com/articles/attribute-based-access-control) system.\nIn XACML, attributes – information about the subject accessing a resource, the resource to be addressed, and the environment – act as inputs for the decision of whether access is granted or not.\nXACML can also be used to implement [role-based access control](https://bliptext.com/articles/role-based-access-control).\nIn XACML, access control decisions to be taken are expressed as Rules.\nEach Rule comprises a series of conditions which decide whether a given request is approved or not.\nIf a Rule is applicable to a request but the conditions within the Rule fail to evaluate, the result is Indeterminate.\nRules are grouped together in Policies, and a PolicySet contains Policies and possibly other PolicySets.\nEach of these also includes a Target, a simple condition that determines whether it should be evaluated for a given request.\nCombining algorithms can be used to combine Rules and Policies with potentially differing results in various ways.\nXACML also supports obligations and advice expressions.\nObligations specify actions which must be executed during the processing of a request, for example for logging.\nAdvice expressions are similar, but may be ignored.\nXACML separates access control functionality into several components.\nEach operating environment in which access control is used has a Policy Enforcement Point (PEP) which implements the functionality to demand authorization and to grant or deny access to resources.\nThese refer to an environment-independent and central Policy Decision Point (PDP) which actually makes the decision on whether access is granted.\nThe PDP refers to policies stored in the Policy Retrieval Point (PRP).\nPolicies are managed through a Policy Administration Point (PAP).\nVersion 3.0 was ratified by OASIS in January 2013.\n\n# History\nVersion 1.0 was ratified by [OASIS](https://bliptext.com/articles/oasis-organization) [standards organization](https://bliptext.com/articles/standards-organization) in 2003.\nVersion 2.0 was ratified by OASIS standards organization on February 1, 2005.\nVersion 3.0 was ratified by OASIS in January 2013.\n\n# Architecture\n\n## Terminology\nNon-normative terminology (following RFC 2904, except for PAP)\n\n## Flow\n# [This image shows the XACML architecture and a sample authorization flow. | upload.wikimedia.org/wikipedia/commons/f/f2/XACML///Architecture///%26///Flow.png]\n\n# Policy elements\n\n## Structural elements\nXACML is structured into 3 levels of elements:\nA policy set can contain any number of policy elements and policy set elements.\nA policy can contain any number of rule elements.\n\n## Attributes and categories\nPolicies, policy sets, rules and requests all use subjects, resources, environments, and actions.\n\n## Targets\nXACML provides a target, which is basically a set of simplified conditions for the subject, resource, and action that must be met for a policy set, policy, or rule to apply to a given request.\nOnce a policy or policy set is found to apply to a given request, its rules are evaluated to determine the access decision and response.\nIn addition to being a way to check applicability, target information also provides a way to index policies, which is useful if you need to store many policies and then quickly sift through them to find which ones apply.\nWhen a request to access that service arrives, the PDP will know where to look for policies that might apply to this request because the policies are indexed based on their target constraints.\nNote that a target may also specify that it applies to any request.\nPolicy set, policy and rule can all contain target elements.\n\n## Conditions\nConditions only exist in rules.\nConditions are essentially an advanced form of a target which can use a broader range of functions and more importantly can be used to compare two or more attributes together, e.g. subject-id==doctor-id.\nWith conditions, it is possible to implement segregation of duty checks or relationship-based access control.\n\n## Obligations & Advice\nWithin XACML, a concept called obligations can be used.\nAn obligation is a directive from the policy decision point (PDP) to the policy enforcement point (PEP) on what must be carried out before or after an access is approved.\nIf the PEP is unable to comply with the directive, the approved access may or must not be realized.\nThe augmentation of obligations eliminates a gap between formal requirements and policy enforcement.\nAn example of an obligation could look like this:\nAccess control rule:\nAllow access to resource MedicalJournal with attribute patientID=x\nif Subject match DesignatedDoctorOfPatient\nand action is read\nwith obligation\non Permit: doLog_Inform(patientID, Subject, time)\non Deny : doLog_UnauthorizedLogin(patientID, Subject, time)\nThe XACML's obligation can be an effective way to meet formal requirements (non-repudiation for example) that can be hard to implement as access control rules.\nFurthermore, any formal requirements will be part of the access control policy as obligations and not as separate functions, which makes policies consistent and centralization of the IT environment easier to achieve.\nObligations can be used for \"break-the-glass\" scenarios or trust elevation (\"you cannot transfer $1,000 without two-factor authentication - here is the link to the 2FA page\").\nIn addition to obligations, XACML supports advice which are identical to obligations with the difference that a PEP is not obligated to enforce the advice (hence its name).\n\n# Combining algorithms\nWhat happens in XACML if there are two rules (or policies) that contradict each other?\nImagine for instance a first rule that would say managers can view documents and a second rule that would say no one can work before 9am.\nWhat if the request is about Alice trying to view a document at 8am?\nWhich rule wins?\nThis is what combining algorithms tell us.\nThey help resolve conflicts.\nXACML defines a number of combining algorithms that can be identified by a RuleCombiningAlgId or PolicyCombiningAlgId attribute of the or elements, respectively.\nThe rule-combining algorithm defines a procedure for arriving at an access decision given the individual results of evaluation of a set of rules.\nSimilarly, the policy-combining algorithm defines a procedure for arriving at an access decision given the individual results of evaluation of a set of policies.\n\n# Functions\nXACML defines a long list of functions (close to 300) to manipulate and compare attributes to other attributes and values:\nThe functions and their identifiers are fully described in the standard.\nFunctions are type-specific i.e. there is a function for string equality and a different one for integer equality.\n\n## Equality, inequality and other matching functions\n\n## Arithmetic functions\nRefer to the standard for a formal definition of these function.\n\n## String functions\nRefer to the standard for a formal definition of these function.\n\n## Logical functions (and, or, not)\n\n## Set and bag functions\n\n## Regular expression functions\n\n## XPath functions\n\n## Higher order functions\nThe list of higher order functions is as listed below.\nFor a formal definition, refer to the XACML standard.\n\n# XACML 3.0\n\n## Schema\nhttp://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd\n\n## Data types\n\n## New in XACML 3.0\n\n### New profiles\nXACML 3.0 introduces administrative delegation, the JSON Profile of XACML (request/response), the REST Profile of XACML, the Multiple Decision Profile of XACML, and many more.\n\n#### Delegation\nThe implementation of delegation is new in XACML 3.0.\nThe delegation mechanism is used to support decentralized administration of access policies.\nIt allows an authority (delegator) to delegate all or parts of its own authority or someone else's authority to another user (delegate) without any need to involve modification of the root policy.\nThis is because, in this delegation model, the delegation rights are separated from the access rights.\nThese are instead referred to as administrative control policies.\nAccess control and administrative policies work together as in the following scenario:\nA partnership of companies' many services are protected by an access control system.\nThe system implements the following central rules to protect its resources and to allow delegation:\nAccess control rules:\nAllow access\nto resource with attribute WebService\nif subject is Employee and action is read or write.\nAdministration control rules:\nAllow delegation of access control rule #1\nto subjects with attribute Consultant.\nConditions:\ndelegation must expire within 6 months,\nresource must not have attribute StrictlyInternal.\n(Attributes can be fetched from an external source, e.g. a LDAP catalog.)\nWhen a consultant enters the corporation, a delegation can be issued locally by the consultant's supervisor, authorizing the consultant access to systems directly.\nThe delegator (the supervisor in this scenario) may only have the right to delegate a limited set of access rights to consultants.\n\n### Other features\nOther new features of XACML 3.0 are listed at http://www.webfarmr.eu/2010/07/enhancements-and-new-features-in-xacml-3-axiomatics/\nThe XACML TC is also publishing a list of changes here: http://wiki.oasis-open.org/xacml/DifferencesBetweenXACML2.0AndXACML3.0\n\n# Sample policies\n\n## Date and time-based authorization in XACML\nThis rule implements the use-it-lose-it access control paradigm.\nIf a user does not log in for 30 days, then they lose access.\nIn pseudo-code: deny if currentDateTime > lastLogin + 30 days\n \n Use it or lose it: this policy denies access if lastLogin is more than 30 days away from today's date \n \n \n \n \n \n \n \n \n P30D \n \n \n \n \n \n\n## Time-based authorization in XACML\nThis rule grants access if the current time is greater than 9am and less than 5pm.\n \n Allow if time between 9 and 5 \n \n \n \n \n 09:00:00 \n \n \n \n \n \n \n \n 17:00:00 \n \n \n \n \n \n \n\n# Sample requests and responses\n\n## XACML 3.0 request\n \n \n \n view \n \n \n \n \n doc#123 \n \n \n \n \n Alice \n \n \n \n\n## XACML 3.0 responses\n\n### XACML 3.0 sample response\n** **\n** **\n** **NotApplicable** **\n** **\n** **\n** **\n** **\n** **\n\n### XACML 3.0 sample response with obligation\nThe following contains an Obligation block.\nObligations are statements that can be returned along with a decision to enrich the decision flow.\nIn this example, the PEP must log that access was granted.\n \n \n Permit \n \n \n \n \n \n \n \n \n http://www.axiomatics.com/automatic-unique-id/18a9eae9-c92b-4087-b2ac-c5a33d7ff477 \n \n \n \n\n# The Multiple Decision Profile of XACML 3.0\nBy default a PDP processes a single request at a time e.g. \"Can Alice view item #1?\".\nThe PDP then replies with a single decision.\nAt times, though, it is necessary to send multiple requests in one go e.g. \"Can Alice view / edit / delete items #1, #2, #3?\".\nThe Multiple Decision Profile of XACML allows for this use case.\nThe PDP will typically do the product of all combinations i.e. in the example aforementioned there will be 1 x 3 x 3 = 9 decisions returned in a single response.\n\n## Sample JSON Request for the Multiple Decision Profile\nThe way to enable the MDP is to send an array of objects for any of the categories rather than an array of one object (or simply an object).\nFor instance, AccessSubject is an object but Resource is an array of objects.\nThe latter will trigger the MDP process in PDPs that support the profile.\nNote as well the use of the IncludeInResult attribute which tells the PDP to return the XACML attribute and its value in the response so that decisions can be correlated to the relevant attribute values.\n{ **\"Request\"**: {\n**\"ReturnPolicyIdList\"**: **true**,\n**\"AccessSubject\"**: {\n**\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.user.username\",\n**\"Value\"**: \"Alice\"\n}] }, **\"Resource\"**: [{\n**\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.objectType\",\n**\"Value\"**: \"record\"\n}, { **\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"123\",\n**\"IncludeInResult\"**: **true**\n}] },{ **\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.objectType\",\n**\"Value\"**: \"record\"\n}, { **\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"124\",\n**\"IncludeInResult\"**: **true**\n}] },{ **\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.objectType\",\n**\"Value\"**: \"record\"\n}, { **\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"125\",\n**\"IncludeInResult\"**: **true**\n}] }], **\"Action\"**: [{\n**\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"view\",\n**\"IncludeInResult\"**: **true**\n}] },{ **\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"edit\",\n**\"IncludeInResult\"**: **true**\n}] },{ **\"Attribute\"**: [{\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"delete\",\n**\"IncludeInResult\"**: **true**\n}] }] } }\n\n## Sample JSON Response for the Multiple Decision Profile\n{ **\"Response\"**: [\n{ **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"3\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"125\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"view\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"2\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"124\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"view\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"123\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"edit\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: {\n**\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n}, **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"123\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"delete\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: {\n**\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n}, **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"3\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"125\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"delete\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"3\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"125\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"edit\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"2\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"124\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"delete\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"123\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"view\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: {\n**\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n}, **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } }, { **\"Decision\"**: \"Deny\",\n**\"Status\"**: {\n**\"StatusCode\"**: {\n**\"Value\"**: \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} }, **\"AssociatedAdvice\"**: {\n**\"Id\"**: \"com.acme.message\",\n**\"AttributeAssignment\"**: [\n{ **\"AttributeId\"**: \"com.acme.messageContent\",\n**\"Value\"**: \"Access denied - insufficient clearance.\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:environment \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n}, { **\"AttributeId\"**: \"com.acme.user.clearance\",\n**\"Value\"**: \"1\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:1.0:subject-category:access-subject \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n}, { **\"AttributeId\"**: \"com.acme.record.classification\",\n**\"Value\"**: \"2\",\n**\"Category\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#integer \"\n} ] }, **\"Category\"**: [\n{ **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:resource \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"124\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} }, { **\"CategoryId\"**: \" urn:oasis:names:tc:xacml:3.0:attribute-category:action \",\n**\"Attribute\"**: {\n**\"AttributeId\"**: \"com.acme.action\",\n**\"Value\"**: \"edit\",\n**\"DataType\"**: \" http://www.w3.org/2001/XMLSchema#string \"\n} } ], **\"PolicyIdentifierList\"**: {\n**\"PolicyIdReference\"**: [\n{ **\"Id\"**: \"311a93c0-6e4c-47a0-8e05-76feb39f25e0\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \"c6b75be8-f3cb-4bda-9b63-812a1f7e5fae\",\n**\"Version\"**: \"1\"\n} ], **\"PolicySetIdReference\"**: [\n{ **\"Id\"**: \"1016337f-f5f8-4ed4-bd4e-9a2be01fa211\",\n**\"Version\"**: \"1\"\n}, { **\"Id\"**: \" http://www.axiomatics.com/automatic-unique-id/5cc13395-20bd-48b3-a56b-68b1c26c3e54 \",\n**\"Version\"**: \"1.0\"\n} ] } } ] }\n\n# Developer orientation\nIn 2013 and 2014, the XACML Technical Committee focused on designing new profiles to facilitate developer integration.\nThese include:\nAll three profiles were showcased at the Cloud Identity Summit 2014 in Monterey, California.\nUsing these profiles, integrating fine-grained authorization into applications becomes much easier.\n\n## The ALFA Profile of XACML\nALFA stands for Abbreviated Language for Authorization.\nIt is a lightweight syntax used to implement policy-based access control policies.\nFor examples refer to the [main article](https://bliptext.com/articles/alfa-xacml).\n\n## The JSON Profile of XACML\nThe JSON profile of XACML simplifies the integration between the PEP and the PDP.\n\n### Sample JSON request\n{ **\"Request\"**: {\n**\"AccessSubject\"**: {\n**\"Attribute\"**: [\n{ **\"AttributeId\"**: \"com.acme.user.employeeId\",\n**\"Value\"**: \"Alice\"\n} ] }, **\"Resource\"**: {\n**\"Attribute\"**: [\n{ **\"AttributeId\"**: \"com.acme.record.recordId\",\n**\"Value\"**: \"123\"\n}, { **\"AttributeId\"**: \"com.acme.object.objectType\",\n**\"Value\"**: \"record\"\n} ] }, **\"Action\"**: {\n**\"Attribute\"**: [\n{ **\"AttributeId\"**: \"com.acme.action.actionId\",\n**\"Value\"**: \"view\"\n} ] }, **\"Environment\"**: {\n**\"Attribute\"**: []\n} } }\n\n## Sample JSON response\n{ **\"Response\"** : {\n**\"Decision\"** : \"Permit\",\n**\"Status\"** : {\n**\"StatusCode\"** : {\n**\"Value\"** : \" urn:oasis:names:tc:xacml:1.0:status:ok \"\n} } } }\n\n# XACML and other standards\n\n## XACML and Open Policy Agent\nXACML is almost entirely a **policy definition language** based on [XML](https://bliptext.com/articles/xml) and [XSLT](https://bliptext.com/articles/xslt), defined by an open [OASIS](https://bliptext.com/articles/oasis-organization) specification.\nThe XACML specification does not cover the design or implementation of Policy Decision Point (PDP), only the policy language they consume.\nMany [proprietary](https://bliptext.com/articles/proprietary-software) and [open-source](https://bliptext.com/articles/open-source-software) PDPs use XACML as their policy definition language.\nOpen Policy Agent (OPA) is an open-source Policy Decision Point (PDP) implementation, capable of interpreting policy language to render policy decisions.\nOPA is a general-purpose PDP implementation which can be used for any scenario where a policy decision is required, much like PDP implementations that support the XACML specification.\nOPA's policy definition language is (Rego), which is a JSON-based, Turing-incomplete language based on Datalog.\nPolicies written in XACML can be translated to Rego, and vice-versa.\n\n## XACML and SAML\n[SAML](https://bliptext.com/articles/security-assertion-markup-language) is an identity SSO and federation standard used for authentication.\nSAML is used as a common identity token format between different applications.\nSAML and XACML are both defined by [OASIS](https://bliptext.com/articles/oasis-organization).\nSAML and XACML were designed to interoperate where SAML is used to carry identity information / virtual identities and XACML is used to drive the access control logic through policies.\n# [Example of cross-enterprise federation where two enterprises federate using SAML and two Security Token Services (STS), establishing a circle of trust. The SAML in this picture is used for identity exchange / virtualization. The XACML is used server-side to determine whether access should be granted to the application functionality (functional access control) and the data behind it (data access control). | upload.wikimedia.org/wikipedia/commons/5/55/Cross-Enterprise///Federation///using///SAML///and///XACML.png]\n\n## XACML and OAuth\n[OAuth 2.0](https://bliptext.com/articles/oauth) is considered to be an authorization standard.\nIt differs from XACML though in its origin, its purpose, and its applications.\nOAuth is about:\nXACML does not handle user approval or delegated access or password management.\nXACML simply provides:\nXACML and OAuth can be combined to deliver a more comprehensive approach to authorization.","revisionCount":0},"hasMore":false,"nextCursor":null}