OGC 07-118r8 User Management Interfaces for EO
48 Copyright © 2010 Open Geospatial Consortium, Inc.
where
AttributeId=urn:ogc:um:eop:0.0.4:saml:role
is a user-defined attribute contained in the XACML decision request which holds the suitable SAML Token
attribute value identifying the group of users subjects to the Rule. Notice that a Rule Target can match more than one Subject.
See annex E for a more comprehensive example.
10.3 Uses Case: restrict access to the type of data
Generic policy rule:
restrict access to the type of data e.g. high or low resolution data Analysis:
XACML allows to define Rules which target specific attributes of the resource to access. However, we assume that this information is either contained in the client request to the
Service, or in a configuration file.
Notice that, building a Rule restricting access for certain data values but these data values are not provided in input, can result in an Indeterminate Policy Indeterminate means that
an error occurred or some required value was missing, so a decision cannot be made.
Example:
See annex E.
10.4 Uses Case: restrict access to data based on the age of the data
Generic policy rule:
restrict access to data based on the age of the data The age of data is an essential parameter to be considered for some products within
EUMETSAT data policy for instance at the moment Meteosat data are only accessible for retrieval from the archive 24 hours after sensing time.
Analysis:
If the age of data is a piece of information contained in the service request, it is possible to define a rule which set restrictions on the access to the data based on their age.
Example:
For example, the following Condition evaluates to true if the current dateTime is greater than the acquisition end time of the data + 24 hours.
Condition Apply FunctionId=urn:oasis:names:tc:xacml:2.0:function: dateTime-greater-than-or-
equal Apply FunctionId=urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only
EnvironmentAttributeDesignator
AttributeId=urn:oasis:names:tc:xacml:1.0:environment:current-dateTime DataType=http:www.w3.org2001XMLSchemadateTime
Apply Apply FunctionId=urn:oasis:names:tc:xacml:1.0:function: dateTime-add-
dayTimeDuration Apply FunctionId=urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only
ResourceAttributeDesignator AttributeId=urn:ogc:def:ebRIM-Slot:OGC-06-131:endPosition
OGC 07-118r8 User Management Interfaces for EO
49 Copyright © 2010 Open Geospatial Consortium, Inc.
DataType=http:www.w3.org2001XMLSchemadateTime Apply
AttributeValue DataType=http:www.w3.orgTR2002WD-xquery-operators-20020816dayTimeDuration
xf:dt-dayTimeDuration
PT24H xf:dt-dayTimeDuration
AttributeValue Apply
Apply Condition
where
AttributeId=urn:ogc:def:ebRIM-Slot:OGC-06-131:endPosition
is a user- defined attribute contained in the XACML decision request which holds the
corresponding value of the service request.
10.5 Uses Case: imposing geographical constraints
