0a99555401a033704f1f171baab6db11fb5528f2Allan Foster DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster The contents of this file are subject to the terms
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster of the Common Development and Distribution License
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster (the License). You may not use this file except in
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster compliance with the License.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster You can obtain a copy of the License at
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster https://opensso.dev.java.net/public/CDDLv1.0.html or
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster See the License for the specific language governing
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster permission and limitations under the License.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster When distributing Covered Code, include this CDDL
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster Header Notice in each file and include the License file
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster If applicable, add the following below the CDDL Header,
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster with the fields enclosed by brackets [] replaced by
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster your own identifying information:
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster "Portions Copyrighted [year] [name of copyright owner]"
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster $Id: policyAdmin.dtd,v 1.7 2009/10/13 21:32:31 veiming Exp $
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- This DTD defines the document structure that will be used by creating
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster policies via commandline interface tools.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster Unique Declaration name for DOCTYPE tag:
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster "OpenSSO Policy Administration DTD"
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Policies is a collection of Policy element -->
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Policy is the root element that defines a named policy rule.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster The attribute "name" provides the policy name, "description" gives
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster a brief description for the policy, "active" specifies the
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster fact whether this policy is currently active or not. Default
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster value is "true". If this value is set to "true" only then
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster this policy is considered during policy evaluation.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster "serviceName" identifies the service name for which the policy is
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster applicable. The attribute "referralPolicy" is used to flag the
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster policy as a referral policy. A referral policy is used for
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster delegation. All action/values defined in the referral policy are
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster ignored during policy evaluation. Conversely, all referrals
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster defined in a non referral policy are ignored during policy
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster The policy element can have one or more rules (Rule)
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster and subjects (Subject) to whom the policy is applied. If the
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster subject is empty, the policy does not apply any users.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster Referrals is collection of Referral(s). Referral is used
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster to facilitate delegating policy definition and/or policy evaluation
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster to a different point such as PeerOrg, SubOrg or a custom plugin.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster Conditions is collection of Condition(s). Condition is used
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster to sepcify restrictions such as time range, auth levels
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster for which the policy applies. ResponseProviders are a collection
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster of ResponseProvider(s). ResponseProvider is used to specify the
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster response attributes which would be returned as part of the PolicyDecision
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster provided the policy applies for the given Subject, ResourceName under
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster the specified Conditions(s).Conditions, Subjects, ResponseProviders and
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster Referrals are containers.They can have 0 or more elements.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster It enables modifying the policies such as removing one elment and adding
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster another element to that container in the policy.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!ELEMENT Policy ( Rule+, Subjects?, Conditions?, Referrals?, ResponseProviders? ) >
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Rule element defines a policy rule that contains a service
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster name, resource name and its action names and corresponding action
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster values. The attribute "name" provides a user friendly name for
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster the rule. The sub-element "ServiceName" gives the name of the
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster service, "ResourceName" give the resource name, and "AttributeValuePair"
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster provides the action names and corresponding action values. A rule can be
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster defined without any actions. A referral policy rule doesn't have any
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!ELEMENT Rule ( ServiceName, ApplicationName?, ResourceName*,
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Application provides the name of the application for which a
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster rule has been created. The attribute "name" provides the application
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- ServiceName provides the name of the service for which a
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster rule has been created. The attribute "name" provides the service
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- ResourceName provides the name of the resource for which
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster a rule has been created. If the service does not have resource,
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster this element will not be there for the rule. The attribute "name"
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster provides the resoruce name.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- ExcludedResourceName provides the name of the excluded resource for which
0a99555401a033704f1f171baab6db11fb5528f2Allan Fostera rule has been created. -->
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Subjects element identifies a collection of users, identified
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster based on their roles, group membership or by listing individual
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster users. The attribute "name" gives a user friendly name for this
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster collection of users. The attribute "includeType" is ignored at
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster present. The policies can be defined without a Subject.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster For example, referral policy doesn't have a Subject
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster includeType (inclusive | exclusive) "inclusive"
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Subject element identifies a user collection plugin
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster written by the customer, in which the attribute "type" giving
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster the plugin name. The attribute "name" gives a user friendly
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster name for this instance of the plugin.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster The attribue "includeType" indicates whether the subject is
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster a normal (non exclusive) subject or exclusive subject.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster If subject is exclusive, policy applies to users who are not
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster members of the subject. Otherwise, policy applies to users
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster who are members of the subject.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster includeType (inclusive | exclusive) "inclusive"
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- RealmSubject element is a reference to a Subject object
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster defined at the realm level.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster The attribue "name" is the name of the Subject object defined
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster at the realm.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster The attribue "includeType" indicates whether the subject is
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster a normal (non exclusive) subject or exclusive subject.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster If subject is exclusive, policy applies to users who are not
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster members of the subject. Otherwise, policy applies to users
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster who are members of the subject.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster includeType (inclusive | exclusive) "inclusive"
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Referrals element identifies a collection of referrals. A policy can
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster be defined without a referral. This facilitates modification of a referral
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster policy such as removing one referral and adding a another referral.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Referral element identifies a referral. Referral is used
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster to facilitate delegating policy definition and/or policy evaluation
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster to a different point such as PeerOrg, SubOrg or a custom plugin
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Conditions element identifies a collection of conditions. The policy can
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster be defined without a Condition. For example, referral policy doesn't have
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Condition element identifies a condition. Condition is used
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster to specify restrictions such as time range, auth levels
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster for which the policy applies
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- ResponseProviders element identifies a collection of responseprovider(s).
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster The policy can be defined without a ResponseProvider.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!ELEMENT ResponseProviders ( ResponseProvider* ) >
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- ResponseProvider element identifies a ResponseProvider.
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster ResponseProvider providers response attributes to be returned in the
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster policy decision if the policy applies given the Subject, Resource and
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!ELEMENT ResponseProvider ( AttributeValuePair* ) >
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!ELEMENT AttributeValuePair (Attribute, (Value)*) >
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster<!-- Attribute must be all one word without spaces. Hence, it is
0a99555401a033704f1f171baab6db11fb5528f2Allan Foster indicated as NMTOKEN below.