Info on XACML PDP Locators?

[paorocce]

Dear all,

  I'm new to this forum, and I don't know if this is the right place to raise these questions. if not, please redirect me.

I'm interested in the SAML profile for XACML provided by the PicketLink / PicketBox. I managed to install and run the PicketLink PDP servlet sample as described in http://community.jboss.org/wiki/SAMLV2AndXACMLV2Integration.

Now I have a couple of questions about policy locators:

1) Is there a Policy Locator to reference all policies in a directory? If yes, how can I configure it? If not, how can I write such one?

2) Is there a way to support policy composition, i.e. to enable the enforcement of policies from different sources? I suppose this could be managed by having more than one locator, can you point me to some more documentations about how to write custom Locators?

Thanks in advance for your answer!

Cheers,

Paolo

[anil.saldhana]

sorry for late reply.

the current 2.0.6 v  has the policies from directory feature.

For the composition of policies from different source, you can look at the source for the ldap policy locator and write your own.

[paorocce]

Dear Anil,

  thaks for your reply, anyway I'm still not able to set a whole directory as source of policies.

I tried using the following configuration for the PDP:

<ns:jbosspdp xmlns:ns="urn:jboss:xacml:2.0">

   <ns:Policies>

      <ns:PolicySet>

         <ns:Location>policies</ns:Location>

     </ns:PolicySet>

   </ns:Policies>

   <ns:Locators>

      <ns:Locator Name="org.jboss.security.xacml.locators.JBossPolicySetLocator">

      </ns:Locator>

   </ns:Locators>

</ns:jbosspdp>

but I get the following error when evaluating a request:

11:26:27,541 ERROR [STDERR] [Fatal Error] :1:1: Content is not allowed in prolog.

11:26:27,543 ERROR [[/pdp]] StandardWrapper.Throwable

java.lang.RuntimeException: java.lang.reflect.InvocationTargetException

    at org.jboss.security.xacml.core.JBossPDP.<init>(JBossPDP.java:114)

    at org.picketlink.identity.federation.web.servlets.saml.SOAPSAMLXACMLServlet.getPDP(SOAPSAMLXACMLServlet.java:268)

Using "policies/mypolicy-policy.xml" in the policyConfig.xml does the work, but then I'm just able to select one policy file from the directory, and not the directory as a whole.

Am I missing something?

Cheers,

Paolo

[anil.saldhana]

Look at example: http://anonsvn.jboss.org/repos/jbossas/projects/security/security-xacml/trunk/jboss-xacml/src/test/resources/locators/rbac/rbac-config.xml

When we look in the directory:

http://anonsvn.jboss.org/repos/jbossas/projects/security/security-xacml/trunk/jboss-xacml/src/test/resources/test/policies/rbac/

[joshc1107]

Anil, I noticed that you're using an RBAC policy locator to do this.  Does this locator introduce any special stipulations for RBAC?  I tried looking for documentation on how the policy locators worked (or even how they differed) but could not find any.  Is this available?