Enable PDP extensions (e.g. Functions) to return an error about invalid attribute values in form of XACML <StatusDetail> / <MissingAttributeDetail>s

[securedimensions]

Additional feature request

When the processing is aborted inside a function with Indeterminate, the current implementation does not support to provide further detailed information <StatusDetail> inside the IndeterminateEvaluationException / ImmutableXacmlStatus.

Asked Feature

Support to populate <MissingAttributeDetail> inside the <StatusDetail>

Example

In the context of implementing an extension for GeoXACML, the following response is an example stating that the AttributeValue "subject-location" was missing from the request. The specific aspect is that an AttributeValue must be encoded using a particular CRS. This example "tells" the PEP that the Attribute 'subject-location' must be sent with CRS=3857 encoded coordinates.

<Response xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17 http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd ">
    <Result>
        <Decision>Indeterminate</Decision>
        <Status>
            <StatusCode Value="crs-error"/>
            <StatusMessage>Function 'urn:ogc:def:function:geoxacml:3.0:geometry-equal' expects same SRS for both geometry parameters</StatusMessage>
            <StatusDetail xmlns:geoxacml="http://www.opengis.net/spec/geoxacml/3.0">
                <MissingAttributeDetail Category="access-subject" AttributeId="subject-location" DataType="urn:ogc:def:dataType:geoxacml:3.0:geometry">
                    <AttributeValue DataType="urn:ogc:def:dataType:geoxacml:3.0:geometry" geoxacml:srid="3857"></AttributeValue>
                </MissingAttributeDetail>
            </StatusDetail>
        </Status>
    </Result>
</Response>

[cdanger]

Now supported in latest release 20.2.0. See the example of custom RequestPreprocessor (PDP extension) adding AttributeId/Category to custom AttributeValues (PDP extension) and the custom function (PDP extension) using this info to throw a standard missing-attribute error with <MissingAttributeDetail> inside a <StatusDetail> element; and also the example of XACML response and PDP configuration.

[securedimensions]

Great! Thank you very much for this quick turnaround!

At the moment I am using these dependencies:

<dependency>
            <groupId>org.ow2.authzforce</groupId>
            <artifactId>authzforce-ce-core-pdp-api</artifactId>
            <version>21.2.0</version>
        </dependency>
        <dependency>
            <groupId>org.ow2.authzforce</groupId>
            <artifactId>authzforce-ce-core-pdp-testutils</artifactId>
            <version>20.1.1</version>
        </dependency>

and I do not see any new version at Maven Repository...

Which would be the corresponding versions for my dependencies once this new feature is out on Maven?

[cdanger]

Version 20.2.0 of authzforce-ce-core-pdp-engine for XACML/XML;
Version 20.2.0 of authzforce-ce-core-pdp-io-xacml-json for XACML/JSON.