ABAC Functions

The Trusted RUBIX Security Policy Markup Language (SPML) provides a variety of functions to manipulate attribute values. Functions exist to compare, transform, mathematically manipulate, perform set operations upon, and perform bag operations upon attribute values. Functions generally accept some number of typed arguments and produce a typed result. Functions may be nested and operate over type values or set of values.

The following table gives the set of functions that are supported by Trusted RUBIX SPML.

equal

not-equal

greater-than

greater-than-or-equal

less-than

less-than-or-equal

time-in-range

dnsName-match

ipAddress-match

regexp-match

MAC-check
 

add

sum

multiply

subtract

mod

divide

round

abs

floor

cast

string-normalize-to-lower-case

concatenate

string-normalize-space
map

or

and

n-of

not

one-and-only

bag-size

is-in

bag

any-of

all-of

any-of-any

all-of-any

any-of-all

all-of-all

map

intersection

union

at-least-one-member-of

subset

set-equals