因此，我正在撰寫一個小程式來讀取 XACML 請求，驗證它是否是有效的 XACML，然后針對策略檢查代碼。
在這項作業中，我找到了 lxml 決議器，它可以將 .xml 檔案驗證為 .xsd 檔案。因此，我對相關模式進行了修改，并在驗證器（http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-policy-schema-os.xsd和http:/ /docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-context-schema-os.xsd），與包含 XACML 請求的 request.xml 檔案進行比較。我遇到的問題是我的程式為驗證回傳 false，這意味著它無效，盡管所有帳戶都應該這樣做。下面列出了有問題的代碼，以及輸入命令和錯誤。
import os
import sys
from ndg import *
from lxml import etree
def checkCorrectXACML(xml_path: str, xsd_path: str) -> bool:
input_schema = etree.parse(xsd_path)
schema = etree.XMLSchema(input_schema)
request = etree.parse(xml_path)
result = schema.validate(request)
return result
def checkPolicy(request):
status: bool
return status
def readRequest():
request = str(sys.argv[1])
if(checkCorrectXACML(request, '/home/foo/Documents/xacml.xsd') == True):
return request
else:
raise Exception('Invalid XACML')
def evaluateRequest():
request = readRequest()
status = checkPolicy(request)
return status
def main():
if(len(sys.argv) == 2):
returnResponse = evaluateRequest()
return returnResponse
else:
raise Exception('You need to provide a request path')
if __name__ == '__main__':
main()
錯誤：
檔案“/home/foo/Documents/XACXML.py”，第 22 行，在 readRequest raise Exception('Invalid XACML') Exception: Invalid XACML
命令：
python3 XACML.py /home/foo/Desktop/Request1.xml
請求1.xml：
<?xml version="1.0" encoding="UTF-8"?>
<Request
xmlns="urn:oasis:names:tc:xacml:1.0:context"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:oasis:names:tc:xacml:1.0:context
cs-xacml-schema-context-01.xsd">
<Subject>
<Attribute
AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue>External user</AttributeValue>
</Attribute>
</Subject>
<Resource>
<Attribute
AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
DataType="http://www.w3.org/2001/XMLSchema#anyURI">
<AttributeValue>http://some.url/foo</AttributeValue>
</Attribute>
</Resource>
<Action>
<Attribute
AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue>read</AttributeValue>
</Attribute>
</Action>
</Request>
uj5u.com熱心網友回復：
感謝 Martin Honnen 指出 XACML 的命名空間與模式的命名空間不匹配。使用具有類似命名空間的請求解決了這個問題。下面是一個 X(AC)ML 示例，它實際上在使用 xmllint 和腳本時都有效。
因此，問題是 xmlns
<?xml version="1.0" encoding="UTF-8"?>
<Request
xmlns="urn:oasis:names:tc:xacml:2.0:context:schema:os"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation=" urn:oasis:names:tc:xacml:2.0:context:schema:os
http://docs.oasis-open.org/xacml/access_control-xacml-2.0-context-schema-os.xsd">
<Subject
SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
DataType="http://www.w3.org/2001/XMLSchema#string" Issuer="xacml20.interop.com">
<AttributeValue>000000</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:xacml:2.0:interop:example:subject:user-name"
DataType="http://www.w3.org/2001/XMLSchema#string" Issuer="xacml20.interop.com">
<AttributeValue>Some name</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:xacml:2.0:interop:example:subject:buy-num-shares"
DataType="http://www.w3.org/2001/XMLSchema#integer"
Issuer="xacml20.interop.com">
<AttributeValue>0000</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:xacml:2.0:interop:example:subject:buy-offer-price"
DataType="http://www.w3.org/2001/XMLSchema#integer"
Issuer="xacml20.interop.com">
<AttributeValue>1</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:xacml:2.0:interop:example:subject:req-credit-ext-approval"
DataType="http://www.w3.org/2001/XMLSchema#string" Issuer="xacml20.interop.com">
<AttributeValue>false</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:xacml:2.0:interop:example:subject:req-trade-approval"
DataType="http://www.w3.org/2001/XMLSchema#string" Issuer="xacml20.interop.com">
<AttributeValue>false</AttributeValue>
</Attribute>
</Subject>
<Resource>
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue>Astring</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:xacml:2.0:interop:example:resource:owner-id"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue>000000</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:xacml:2.0:interop:example:resource:owner-name"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue>Somename</AttributeValue>
</Attribute>
<!-- WE GET THIS VIA THE ATTRIBUTE LOCATOR
<Attribute AttributeId="urn:xacml:2.0:interop:example:resource:account-status"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue>Active</AttributeValue>
</Attribute>
-->
<Attribute AttributeId="urn:xacml:2.0:interop:example:resource:credit-line"
DataType="http://www.w3.org/2001/XMLSchema#integer">
<AttributeValue>15000</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:xacml:2.0:interop:example:resource:current-credit"
DataType="http://www.w3.org/2001/XMLSchema#integer">
<AttributeValue>10000</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:xacml:2.0:interop:example:resource:trade-limit"
DataType="http://www.w3.org/2001/XMLSchema#integer">
<AttributeValue>10000</AttributeValue>
</Attribute>
</Resource>
<Action>
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue>Buy</AttributeValue>
</Attribute>
</Action>
<Environment/>
</Request>
轉載請註明出處，本文鏈接：https://www.uj5u.com/gongcheng/349215.html