<?xml version="1.0" encoding="UTF-8"?>
<PolicySet PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:deny-overrides" PolicySetId="urn:elga:bes:2013:1.2.40.0.34.72.103.1" xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:policy:schema:os http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-policy-schema-os.xsd">
    <Description>The general request policy for time based access for the GDA</Description>
    <Target/>

    <Policy PolicyId="urn:elga:bes:2013:1.2.40.0.34.72.103.1.1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os">
        <Description>Policy that denies if no permit role did match</Description>
        <Target/>

        <Rule RuleId="urn:elga:bes:2013:1.2.40.0.34.72.103.1.1.1" Effect="Permit">
            <Condition>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                        <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <!-- Arzt -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">700</AttributeValue>
                            <!-- Zahnarzt -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">701</AttributeValue>
                            <!-- Krankenanstalt -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">702</AttributeValue>
                            <!-- Pflegeeinrichtungen -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">703</AttributeValue>
                            <!-- Labor -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">724</AttributeValue>
                            <!-- Rettungsdienst -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">728</AttributeValue>
                            <!-- Gesundheitsberatung 1450 -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">729</AttributeValue>
                        </Apply>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                        <SubjectAttributeDesignator AttributeId="urn:elga:bes:kbtype" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K101</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K103</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K102</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K104</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K105</AttributeValue>                            
                        </Apply>
                    </Apply>
                </Apply>
            </Condition>
        </Rule>

        <Rule RuleId="urn:elga:bes:2013:1.2.40.0.34.72.103.1.1.2" Effect="Permit">
            <Condition>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                        <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <!-- Apotheke -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">704</AttributeValue>
                        </Apply>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                        <SubjectAttributeDesignator AttributeId="urn:elga:bes:kbtype" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K102</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K105</AttributeValue>                            
                        </Apply>
                    </Apply>
                </Apply>
            </Condition>
        </Rule>

        <Rule Effect="Deny" RuleId="urn:oasis:names:tc:xacml:2.0:example:SimpleRule1"/>

    </Policy>

    <Policy PolicyId="urn:elga:bes:2013:1.2.40.0.34.72.103.1.2" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os">
        <Target/>
        <Rule RuleId="urn:elga:bes:2013:1.2.40.0.34.72.103.1.2.1" Effect="Permit">
            <Condition>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-less-than-or-equal">
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-one-and-only">
                            <EnvironmentAttributeDesignator AttributeId="urn:elga:bes:2013:kbs" DataType="http://www.w3.org/2001/XMLSchema#double"/>
                        </Apply>
                        <!-- value in seconds - 1 day for test stage 90 days for produktion system -->
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#double">7776000</AttributeValue>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                        <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <!-- Arzt -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">700</AttributeValue>
                            <!-- Zahnarzt -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">701</AttributeValue>
                            <!-- Krankenanstalt -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">702</AttributeValue>
                            <!-- Pflegeeinrichtungen -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">703</AttributeValue>
                            <!-- Labor -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">724</AttributeValue>
                        </Apply>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                        <SubjectAttributeDesignator AttributeId="urn:elga:bes:kbtype" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K101</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K103</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K102</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K104</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K105</AttributeValue>                            
                        </Apply>
                    </Apply>
                </Apply>
            </Condition>
        </Rule>

        <Rule RuleId="urn:elga:bes:2013:1.2.40.0.34.72.103.1.2.2" Effect="Permit">
            <Condition>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-less-than-or-equal">
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-one-and-only">
                            <EnvironmentAttributeDesignator AttributeId="urn:elga:bes:2013:kbs" DataType="http://www.w3.org/2001/XMLSchema#double"/>
                        </Apply>
                        <!-- value in seconds - 28 days -->
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#double">2419200</AttributeValue>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                        <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <!-- Apotheke -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">704</AttributeValue>
                            <!-- Rettungsdienst K102 only - checked by KBS-->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">728</AttributeValue>
                            <!-- Gesundheitsberatung 1450 K105 only - checked by KBS -->
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">729</AttributeValue>                            
                        </Apply>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                        <SubjectAttributeDesignator AttributeId="urn:elga:bes:kbtype" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K102</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">K105</AttributeValue>                            
                        </Apply>
                    </Apply>
                </Apply>
            </Condition>
        </Rule>

        <Rule RuleId="denyAll" Effect="Deny"/>

    </Policy>

</PolicySet>
