Use Case: Use Case:

OGC 07-118r9 58 Copyright © 2014 Open Geospatial Consortium See Annex E for a more comprehensive example.

10.3 Use Case:

restrict access to the type of data Generic policy rule: Restrict access to the type of data e.g. high or low resolution data Analysis: XACML allows to define Rules which target specific attributes of the resource to access. However, we assume that this information is either contained in the client request to the Service, or in a configuration file. Notice that, building a Rule restricting access for certain data values but these data values are not provided in input, can result in an Indeterminate Policy Indeterminate means that an error occurred or some required value was missing, so a decision cannot be made. Example: See Annex E.

10.4 Use Case:

restrict access to data based on the age of the data Generic policy rule: Restrict access to data based on the age of the data The age of data is an essential parameter to be considered for some products within EUMETSAT data policy for instance at the moment Meteosat data are only accessible for retrieval from the archive 24 hours after sensing time. Analysis: If the age of data is a piece of information contained in the service request, it is possible to define a rule which sets restrictions on the access to the data based on their age. Example: For example, the following Condition evaluates to true if the current dateTime is greater than the acquisition end time of the data + 24 hours. Condition Apply FunctionId = urn:oasis:names:tc:xacml:2.0:function:dateTime-greater-than-or- equal Apply FunctionId = urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only EnvironmentAttributeDesignator AttributeId = urn:oasis:names:tc:xacml:1.0:environment:current-dateTime DataType = http:www.w3.org2001XMLSchemadateTime Apply Apply FunctionId = urn:oasis:names:tc:xacml:1.0:function:dateTime-add- dayTimeDuration Apply FunctionId = urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and- only ResourceAttributeDesignator AttributeId = urn:ogc:def:ebRIM-Slot:OGC-06-131:endPosition DataType = http:www.w3.org2001XMLSchemadateTime Apply AttributeValue DataType = http:www.w3.orgTR2002WD-xquery-operators- 20020816dayTimeDuration xf:dt-dayTimeDuration PT24H xf:dt-dayTimeDuration AttributeValue OGC 07-118r9 59 Copyright © 2014 Open Geospatial Consortium Apply Apply Condition where AttributeId=urn:ogc:def:ebRIM-Slot:OGC-06-131:endPosition is a user- defined attribute contained in the XACML decision request which holds the corresponding value of the service request.

10.5 Use Case: