AC Entity Evaluation¶
After the parser created the AST, we want a boolean value.
The following figure shows the AST for the condition subject.email == ‘firstname.lastname@example.org’ and exists object.var. We show the transformation process with the AC context that only contains the key email in the subject mapping with the value email@example.com.
Given this AST and the access context (the attributes), we now must return a boolean value. We do this by transforming the AST step by step, starting at the leaves. This is done by transformers. A transformer is called automatically by the parser library lark and can edit the leave arbitrarily.
Broadly classified, there are the attributes transformer, operator transformers, middle level and top level transformers. To increase performance of the tree evaluation, all transformers are combined and called as needed. To illustrate the how the system works, we show the result of every transformer seperately.
Attribute transformers (TransformAttr) replace the Token object with the attribute key by the real attribute. Exemplarily we show the substition of subject attributes.
1 2 3 4 5 6 7 8 9 10
def subject_attr(self, args: List) -> Any: attr_str = str(args) attr = reduce( lambda d, key: d.get(key, None) if isinstance(d, Mapping) else None, attr_str.split("."), self.data["subject"]) if attr is None: raise SubjectAttributeMissing("No subject_attr %s" % str(args), args) return attr
The args are the children of the subject_attr node. There is only one child, the Token object with the string ‘email’. To support dictionary lookups we split this key string at the dots and use a lambda function to recursively walk the dictionary. The lambda function expects two arguments: an dictionary and a key. If the dictionary typ is a mapping, i.e. we can access elements with a key, we return this dictionary lookup. This lambda function is executed for every element in the split-up key list by the reduce function. The start dictionary is in this case the subject atribute dictionary. If the function was not able to find a attribute an exception is raised.
This is why we have the special exists transformer. The exists tranformer is run before all other transformers. It transforms a uop node to the string exists if and only if the text in the token is literally ‘exists’. Furthermore a single node is transformed if and only if the first child is the string exists. The attributes are substituted using the previously described transformer functions but the exeptions thrown by missing attributes are catched and in the case of an exception exists evaluated to False else to True.
Operator transformers replace the Token object with a function reference. Every operator is implemented in its own class. Through inheritance, some type checks can be performed, e.g. the BinarySameTypeOperator checks if the types of the operators are the same and the BinaryStringOperator checks if both operands are strings. This function reference is then executed by the middle level transformers.
Applicated to our example, the operator tokens got replaced by a class.
The nodes comparison, single and linked are transformed with middle level transformers. For the linked statement its important that it does not change the tree if the children are not already transformed.
Top level transformers, like statement, condition or target, then pass the results of middle level transformers through, but forcing the value to be boolean.
For the linked statement we need to re-apply a middle level transformer.
We use two conflict resolution algorithm: ANY and AND.
The ANY algorithm evaluates to GRANT as soon as any of the contained ac entities evaluated to GRANT. After the first GRANT is transmitted to the conflict resolution, check_break will return True and get_result will return GRANT. If none of the ac entity evaluated to DENY or GRANT, the conflict resolution will return None. If no ac entity evaluated to GRANT but at least one entity evaluated to DENY, DENY is returend.
The AND algorithm evalutes to GRANT only if at least one of the contained ac entities evaluated to GRANT and every other entity evaluated to GRANT or None. After the first DENY is transmitted to the conflict resolution, check_break will return True and get_result returns DENY.
TODO: Move into Implementation chapter In the evaluation of an ac entity two errors can occur: a missing AC entity or missing attributes of the subject, object, environment or access.
Missing ac entities¶
If an ac entity is missing, e.g. a typing error, a log message is generated with the log level Warning. The referencing entity evaluates to None in this case. Note that this is only true if the missing entity type is called for evaluation, i.e. if the conflict resolution algorithm already decided the result of the policy, a missing rule will not change this result.
If the evaluation tries to access an argument that is not provided by the corresponding dictionary, an exception of one of the following types is raised:
The evaluation process catches these exceptions sets his result to None and if an subject attribute was missing, adds the key to a list. After all AC entities are evaluated, the ac entity that started the evaluation has a list of all subject attributes that are missing.