Format and constraints of rules

The rule must be written in a valid XSL template rule format and must return a text document that contains one of the following string identifiers:

• !TRUE!
• !FALSE!
• !INDIFFERENT!

The identifiers must be the only text in the output document but they can be surrounded by white space. The identifiers are not case-sensitive. A value other than one of the identifiers listed or an empty document might be returned. The access decision fails and an error code is returned to the resource manager to indicate that the rule is not compliant. See Authorization rules evaluator.

The following example references the XML data item that is defined in JohnSmith. The condition that the following example rule evaluates is expressed, as follows:

if ((AmountReqd + Credit Card Balance) < Credit Card Limit
     && MileagePlus Status is "100k")

The corresponding authorization rule is:

<xsl:if test="(AmountReqd + JohnSmith/CreditCard/Balance)
  &lt; JohnSmith/CreditCard/Limit
    and JohnSmith/MileagePlus/MemberStatus = '100k'">
  !TRUE!
</xsl:if>

This example rule is the simplest form for specifying an authorization rule. It does not include its own template match statement and it accepts the default template match statement, which is set to /XMLADI. Template match statements are an XSL language construct that is used to select the point in the hierarchy of an XML document at which the XSL rules, which are contained within the template match statement, are applied. The default template match statement of the ADI XML model matches from the top of the XMLADI document by specifying the XPath /XMLADI.

To add your own template match statement to a rule definition, only two additional lines are needed. For example, you might rewrite the example to include your own explicit template match statement that matches from the root of the XMLADI document. Modify the rule as follows:

<xsl:template match="/XMLADI">
<xsl:if test="(AmountReqd + JohnSmith/CreditCard/Balance)
  &lt; JohnSmith/CreditCard/Limit
    and JohnSmith/MileagePlus/MemberStatus = '100k')
  !TRUE!
</xsl:if>
</xsl:template>

Policy administrators must also make the following assumptions about the XSL style sheet document that is created by the rules evaluator to contain the rule that they devise:

• If a style sheet prolog is specified in the azn client configuration file, that prolog is imported into the empty style sheet. If no prolog is specified, the following default prolog is used instead:

  <!-- Required for XSLT language -->
  <?xml version="1.0" encoding='UTF-8'?>
  <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
            version="1.0">
  
  <!-- Required to constrain output of rule evaluation -->
  <xsl:output method="text" omit-xml-declaration="yes"
            encoding='UTF=8' indent="no"/>
  
  <!-- Need this to ensure default text node printing is off -->
  <xsl:template match="text()"></xsl:template>

• Among other things, this prolog sets the XSL style sheet syntax to version 1.0, which is supported by the embedded XSL processor. The prolog sets the namespace for XSL documents to xsl, which requires that all XSL language-specific identities be prefixed by xsl:. This prefix is the standard mode of operation for XSL style sheets. Most attributes in this prolog must be in the style sheet. If not, the results that are returned from the rules evaluator do not conform to the expected results.
• All authorization rules must be enclosed in an xsl:template match statement. If the rule is defined with its own xsl:template match statement, the rule is accepted as is. This acceptance allows the rule creator to specify the level within the ADI XML document at which the rule matches data items. In this case, the match statement must be the first statement encountered by the evaluator when validating the rule. Otherwise, it is assumed that there is no template match statement. If there is a match statement but the match statement does not begin with the /XMLADI absolute path, the rule is returned as not valid. Relative match statements are not accepted at this level.
• If no match statement is specified in the rule, the rule is automatically enclosed in the following match statement:

  <xsl:template match="/XMLADI">
  			...
  <xsl:template>

• Therefore, all rules devised without an explicit template match statement must use XPath expressions that assume the XML context node is /XMLADI. The XPath expression for any ADI item must begin with the container name of the item and must be fully qualified.

<xsl:choose><xsl:when test="(((azn_cred_principal_name='9410431')) \
 or ((azn_cred_principal_name='user1')) \
 or ((azn_cred_principal_name='user2')) \
 ...
 or ((azn_cred_principal_name='user500'))\
 )">!TRUE!</xsl:when><xsl:otherwise>!FALSE!</xsl:otherwise></xsl:choose>