Policy without PolicySet about server

[cdanger]

Thanks. I think the error message is not appropriate for the end-user. So we shall improve it in the next release.
Anyway, the workaround I gave you is the way to go. So feel free to use it to work with both Policy and PolicySet elements on AuthzForce server. (For instance, you may use XSLT to transform Policies into PolicySets automatically with this method.)

[cdanger]

Where does this error show exactly? In the server's HTTP response? To which HTTP request?

Indeed, you cannot upload a XACML Policy alone as message body to the REST API, but you can do with an equivalent PolicySet: put your Policy P (and P only) in an enclosing PolicySet PS that uses first-applicable policy combining algorithm (or only-one-applicable, it does not matter); and it will give the same results.

[welkson]

Hi @cdanger

My policy (file: NewTicketOnlySupport.xml):

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"  PolicyId="NewTicketOnlySupport" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-unless-permit" Version="1.0">
   <Target></Target>
   <Rule Effect="Permit" RuleId="NewTicket">
      <Target>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">/new_ticket</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
               </Match>
            </AllOf>
         </AnyOf>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">POST</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
               </Match>
            </AllOf>
         </AnyOf>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">support</AttributeValue>
                  <AttributeDesignator AttributeId="http://wso2.org/claims/role" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"></AttributeDesignator>
               </Match>
            </AllOf>
         </AnyOf>
      </Target>
   </Rule>
</Policy>

Tests using cURL:

$ curl --request "POST" --header "Content-Type: application/xml;charset=UTF-8" \
     --data @NewTicketOnlySupport.xml --header "Accept: application/xml" \
     -vL \
     http://127.0.0.1:8080/authzforce-ce/domains/fWKzEpWXEeeFTwJCrBEAAg/pap/policies

Result:

* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> POST /authzforce-ce/domains/fWKzEpWXEeeFTwJCrBEAAg/pap/policies HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: curl/7.54.0
> Content-Type: application/xml;charset=UTF-8
> Accept: application/xml
> Content-Length: 1949
> Expect: 100-continue
> 
< HTTP/1.1 100 
* We are completely uploaded and fine
< HTTP/1.1 400 
< Date: Mon, 11 Sep 2017 23:18:13 GMT
< Content-Type: application/xml
< Content-Length: 467
< Connection: close
< 
* Closing connection 0
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><ns2:error xmlns="http://www.w3.org/2005/Atom" xmlns:ns2="http://authzforce.github.io/rest-api-model/xmlns/authz/5" xmlns:ns3="http://authzforce.github.io/core/xmlns/pdp/5.0" xmlns:ns4="http://authzforce.github.io/pap-dao-flat-file/xmlns/properties/3.6"><ns2:message>Cannot cast oasis.names.tc.xacml._3_0.core.schema.wd_17.Policy to oasis.names.tc.xacml._3_0.core.schema.wd_17.PolicySet</ns2:message></ns2:error>%    

[welkson]

Hi @cdanger

I'm working in a API to manipulate policies PAP Agnostic (e.g. WSO2 IS, AuthZForce, OpenAM) in Python.

I tested some alternatives of models transformations in Python (e.g. PyCORE, GenerateDS), but not got success.

XSLT I have not tested. Apparently it's simple in Python [1]

[1] https://stackoverflow.com/questions/16698935/how-to-transform-an-xml-file-using-xslt-in-python