permission-mli-vi-request-operations.xml

<?xml version="1.0"?>
<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" 
		xmlns:xacml ="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"  
		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
		xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17 http://docs.oasis-open.org/xacml/3.0/xacml-core-v3-schema-wd-17.xsd" 
		xmlns:md="http:www.med.example.com/schemas/record.xsd" 
		PolicyId="permission:mli:vi-request-operations" Version="1.0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:permit-overrides">		
	<Target/>

	<Rule RuleId="http://geysers.eu/upperlicl/mli/vi-request-operations" Effect="Permit">
	    <Target>
			<AnyOf>
				<AllOf>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://geysers.eu/upperlicl/resource/resource-type/VI-Request</AttributeValue>
						<AttributeDesignator AttributeId="http://authz-interop.org/AAA/xacml/resource/resource-type" 
											 DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</Match>
				</AllOf>
			</AnyOf>
			
			<AnyOf>
				<!-- A VIO is allowed to query VI request status -->
				<AllOf>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">MLI:Query-VI-Request-Status</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
											 DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</Match>
				</AllOf>
				<!--A VIO is allowed to get SLA offer of sent VI request -->
				<AllOf>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">MLI:Get-SLA-Offer</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
											 DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</Match>
				</AllOf>
				<!-- A VIO is allowed to sign SLA Offer of sent VI request -->
				<AllOf>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">MLI:Sign-SLA-Offer</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
											 DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</Match>
				</AllOf>			
			</AnyOf>
	    </Target>
	</Rule>		
</Policy>