<!--

    *******************************************************************************
    * Copyright © Temenos Headquarters SA 2021. All rights reserved.
    *******************************************************************************

-->
<PolicySet xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" Version="1.0" PolicySetId="ADMIN" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-unless-permit">
	<Description>ADMIN Access to ALL API's</Description>
	<Target>
		<AnyOf>
			<AllOf>
				<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">ADMIN</AttributeValue>
					<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:roleId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:subject" MustBePresent="true"/>
				</Match>
			</AllOf>
		</AnyOf>
	</Target>
	<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="ALL-API-ACCESS" Version="1.0" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-unless-permit">
		<Description>Access to ALL API's to ADMIN role</Description>
		<PolicyDefaults>
			<XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</XPathVersion>
		</PolicyDefaults>
		<Target>
			<AnyOf>
				<AllOf>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">SERVICEREQUEST</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceManagerId" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
					<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">API</AttributeValue>
						<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resourceType" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" MustBePresent="true"/>
					</Match>
				</AllOf>
			</AnyOf>
		</Target>
		<Rule RuleId="allow-from-issuer" Effect="Permit">
				<Description>Issuer check</Description>
			<Condition>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
					<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
						<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
							<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
								<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:issuer" DataType="http://www.w3.org/2001/XMLSchema#string" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:subject" MustBePresent="true"/>
							</Apply>
							<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Fabric</AttributeValue>
						</Apply>
					</Apply>
				</Apply>
			</Condition>
		</Rule>
	</Policy>
</PolicySet>