+

Stack Overflow: What’s the difference between policy target and rule target in XACML?

Are you looking for further clarification in working with XACML? This post originally appeared on Stack Overflow.

Question: XACML allows us to specify <Target> tag in both <Policy> as well as in <Rule> tags.

What I would like to understand is that:

  • What is the utility of having these at both levels?
  • What is the individual effect of both of these methods?
  • How and when one should use them together or separately?

Any help in this regard would be appreciated. Thanks.

Answer:

You can have a Target in PolicySetPolicy, and Rule. They all achieve the same thing i.e. restrict the scope of the element (PolicySetPolicy, or Rule).

Your question should be more around why the three elements? it’s actually a way to divide and conquer your authorization challenge. Imagine you’re tackling authorization for an entire bank. You might have a policy set that focuses on the retail part of the bank and another that focuses on the commercial side of the bank. You would have an attribute in the target of the PolicySet element that would distinguish between retail and commercial.

Inside the retail bank PolicySet you could have another series of policy sets or maybe just policies where the Target would distinguish between different applications. Inside each Policy element you could have Rule elements that would have targets that would distinguish between functions of the applications.

Answered by David Brossard, VP of Customer Relations at Axiomatics

Related Articles

Meeting today’s dynamic authorization and access challenges: The Axiomatics story | Dynamically Speaking
Dynamically Speaking
For more than 15 years, Axiomatics has worked with companies worldwide to define and deliver solutions to the most complex authorization and access challenge. In...
Getting started with Zero Trust using dynamic authorization | Dynamically Speaking
Dynamically Speaking
Zero Trust. It’s everywhere. It’s a methodology that’s been around for years, and we are now seeing a significant uptick in the number of enterprises...
The case for dynamic authorization in banking and finance
Attribute Based Access Control (ABAC)
More than other organizations, banks, and financial institutions face the highest levels of scrutiny when it comes to how they protect critical assets and sensitive...