JBossXACML: Bug in HigherOrderFunction Class of sun's XACML

[karink]

Hi,

there seem's to be a bug in the Class HigherOrderFunction of Sun's XACML implementation

public void checkInputs(List inputs) throws IllegalArgumentException {
...

 // make sure the two args are of the same type
 if (! eval1.getType().equals(eval2.getType()))
 throw new IllegalArgumentException("input types to the any/all " +
 "functions must match");

 ...
 }

The code will not work with function
urn:oasis:names:tc:xacml:2.0:function:anyURI-regexp-match (where the spec defines that the two arguments must not be from the same type) -> see also p. 124 of document http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-core-spec-os.pdf

Do you know if there exists a bug fix from sun?

Regards Karin

[anil.saldhana]

Hi Karin,
I cannot reproduce the issue with a policy that I mashed up.

http://anonsvn.jboss.org/repos/jbossas/projects/security/security-xacml/trunk/jboss-sunxacml/src/test/resources/policies/function-match/function-match-policy-01.xml

I have been fixing bugs since 2.0.3.CR3. Not sure if that has any effect. Here is the latest snapshot.
http://snapshots.jboss.org/maven2/org/jboss/security/jbossxacml/2.0.3.CR3-SNAPSHOT/

Remember you need just one jbossxacml.jar (No need for jboss-xacml.jar and jboss-sunxacml.jar).

If you still have issues, you can email me your test policy (of course not the entire policy set collection) highlighting your problem.

Since I am currently participating in an xacml interoperability exercise, I will be making frequent CR releases. I plan to put out a CR4 release this week. JBossXACML2.0.3 version will arrive in April.

[joergw]

Hi Anil,

The issue can be reproduced using "anyURI-regexp-match" inside an "any-of" function. In that case the following fix in HigherOrderFunction of the original sunxacml implementation is needed: http://sunxacml.svn.sourceforge.net/viewvc/sunxacml/trunk/sunxacml/com/sun/xacml/cond/HigherOrderFunction.java?r1=112&r2=114.

The following condition cannot be evaluated:

...
<Condition>
 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
 <Function FunctionId="urn:oasis:names:tc:xacml:2.0:function:anyURI-regexp-match"/>
 <AttributeValue
 DataType="http://www.w3.org/2001/XMLSchema#string">.*100101</AttributeValue>
 <SubjectAttributeDesignator
 DataType="http://www.w3.org/2001/XMLSchema#anyURI"
 AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role"/>
 </Apply>
</Condition>
...

I'll send you an email with a policy and a request to reproduce this issue. It is still present in 2.0.3.CR3-SNAPSHOT.

Regards, Joerg

[anil.saldhana]

Thanks for the policy. I can reproduce the issue. I will upload a snapshot later in the day with the fix and the CR4 release will be tomorrow.

[anil.saldhana]

Please pick the March 24th snapshot from the location above.

The CR4 release tomorrow will contain it.

[joergw]

Hi Anil,

I have tested jbossxacml-2.0.3.CR4.jar against our policies. Now our issue with HigherOrderFunction is solved!

Thanks a lot for your very fast reaction.

Best regards, Joerg