OGC 07-118r9
58
Copyright © 2014 Open Geospatial Consortium
See Annex E for a more comprehensive example.
10.3 Use Case:
restrict access to the type of data
Generic policy rule:
Restrict access to the type of data e.g. high or low resolution data Analysis:
XACML allows to define Rules which target specific attributes of the resource to access. However, we assume that this information is either contained in the client request to the
Service, or in a configuration file.
Notice that, building a Rule restricting access for certain data values but these data values are not provided in input, can result in an Indeterminate Policy
Indeterminate means that an error occurred or some required value was missing, so a decision cannot be made.
Example:
See Annex E.
10.4 Use Case:
restrict access to data based on the age of the data
Generic policy rule:
Restrict access to data based on the age of the data The age of data is an essential parameter to be considered for some products within
EUMETSAT data policy for instance at the moment Meteosat data are only accessible for retrieval from the archive 24 hours after sensing time.
Analysis:
If the age of data is a piece of information contained in the service request, it is possible to define a rule which sets restrictions on the access to the data based on their age.
Example:
For example, the following Condition evaluates to true if the current dateTime is greater than the acquisition end time of the data + 24 hours.
Condition Apply
FunctionId =
urn:oasis:names:tc:xacml:2.0:function:dateTime-greater-than-or- equal
Apply FunctionId
= urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only
EnvironmentAttributeDesignator AttributeId
= urn:oasis:names:tc:xacml:1.0:environment:current-dateTime
DataType =
http:www.w3.org2001XMLSchemadateTime Apply
Apply FunctionId
= urn:oasis:names:tc:xacml:1.0:function:dateTime-add-
dayTimeDuration Apply
FunctionId =
urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and- only
ResourceAttributeDesignator AttributeId
= urn:ogc:def:ebRIM-Slot:OGC-06-131:endPosition
DataType =
http:www.w3.org2001XMLSchemadateTime Apply
AttributeValue DataType
= http:www.w3.orgTR2002WD-xquery-operators-
20020816dayTimeDuration xf:dt-dayTimeDuration
PT24H xf:dt-dayTimeDuration
AttributeValue
OGC 07-118r9
59
Copyright © 2014 Open Geospatial Consortium
Apply Apply
Condition
where
AttributeId=urn:ogc:def:ebRIM-Slot:OGC-06-131:endPosition
is a user- defined attribute contained in the XACML decision request which holds the
corresponding value of the service request.
10.5 Use Case: