These tests are non-normative and do not constitute a full test of conformance to the XACML Version 2.0 Standard. A full description of the requirements for conformance is included in Section 10. Conformance of the XACML Version 2.0 specification. There is no OASIS- or XACML TC- sponsored branding or certification program for XACML.
Tests are divided into groups based on the primary area of functionality or schema being exercised.
Each test case consists of three XML documents (or sets of documents):
Each XML document is named according to the section of this document in which it occurs. For example, the XML documents for the test in Part II (Mandatory to implement), Section B (Target Matching), Test Case 8 (Case: match: multiple actions) are named:
Explanation of consistent with:
The request and response used in executing these tests need not be instances of the XACML Context Schema. The request and response should, however, contain exactly the same information as the given Request and Response file, and should exercise the XACML policy evaluation functionality that the test is intended to exercise. It should be possible, at least conceptually, to mechanically convert the request and response used in the implementation to the given XACML Request and Response instances.
*Policy.xmlfile for the given test in the repository you use for policies, such that the specified
*Policy.xmlis the only policy that will be retrieved by the PDP, or
*Policy.xmlfile as its initial policy.
*Request.xmlfile (or its semantic equivalent in your system) to the Context Handler component of the XACML PDP via your access control decision request API.
*Response.xmlfile (or its semantic equivalent in your system).
While this suite of tests is non-normative, we hope the suite will represent a general consensus as to the intent of the XACML Version 2.0 Standard. For this reason, contributed tests are marked **EXPERIMENTAL** until the tests have undergone successful review and use, defined as follows:
Once the tests have undergone successful review and use, then the **EXPERIMENTAL** status will be removed.
If an objection is reported on the xacml-comment mailing list to an **EXPERIMENTAL** test during the review period, then the test will be removed from the test suite on the next update unless the XACML TC upholds the objection. It is up to the test submitter to request review by the TC, and it is up to the TC to decide whether or not to review a test.
If an objection is reported to a test that is no longer **EXPERIMENTAL**, the objection is treated as a bug. See Bugs in the Tests for a description of how bugs are handled.
If you believe any test does not correctly interpret the intent of the eXtensible Access Control Markup Language (XACML) Version 2.0 OASIS Standard, or if you find any additional errors in these tests, please submit a report to the email@example.com mailing list. Absent any objections to a bug report, minor bugs may be fixed at the test editor's discretion in the next test suite update.
Major or controversial bugs reported against non-**EXPERIMENTAL** tests will be reviewed by the XACML TC. If the TC agrees that the test does not conform to the intent of the XACML Version 2.0 Standard, then the test will be modified or removed as appropriate on the next test suite update.
Major or controversial bugs reported against tests marked **EXPERIMENTAL** will be treated as an objection to the test. See Contributions of New Tests for the handling of such objections.
Periodically, an updated copy of the entire Conformance Test Suite, containing all corrections to date, will be posted to the XACML TC Web Site.
<test ID>Special.txt) file.
ARITHMETIC CONVERSION FUNCTIONS
See also DURATION-EQUALS TESTS below.
COMPARISON FUNCTIONS: GREATER THAN, GREATER THAN OR EQUAL
rfc822Name and x500Name MATCHING FUNCTIONS
STRING NORMALIZATION FUNCTIONS
See also DURATION-EQUALS TESTS below.
COMPARISON FUNCTIONS: LESS THAN, LESS THAN OR EQUAL
HIGHER-ORDER BAG FUNCTIONS
These tests exercise obligations (Special Instructions).
For rule combining algorithms:
For policy combining algorithms:
These tests exercise policy evaluation for hierarchical resources (Special Instructions).
These tests exercise attribute selectors (Special Instructions).
These tests exercise each of the non-mandatory functions