title: How to write XACML Policy using Custom Attributes
body: <p>I'm trying to write an XACML policy that will utilize a custom attribute. I'm thinking of something like:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Policy xmlns="urn:oasis:names:tc:xacml:1.0:policy"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" PolicyId="deny-demo100"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable"&gt;
    &lt;Description&gt; &lt;/Description&gt;
    &lt;Target&gt;
      &lt;Subjects&gt;
        &lt;AnySubject/&gt;
      &lt;/Subjects&gt;
      &lt;Resources&gt;
    &lt;AnyResource/&gt;
  &lt;/Resources&gt;
  &lt;Actions&gt;
    &lt;AnyAction/&gt;
  &lt;/Actions&gt;
    &lt;/Target&gt;
  
    &lt;Rule Effect="Deny" RuleId="rule-deny-demo100"&gt;
      &lt;Target&gt;
        &lt;Subjects&gt;
          &lt;AnySubject/&gt;
        &lt;/Subjects&gt;
        &lt;Resources&gt;
          &lt;Resource&gt;
             &lt;AnyResource/&gt;
          &lt;/Resource&gt;
        &lt;/Resources&gt;
        &lt;Actions&gt;
          &lt;Action&gt;
            &lt;ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"&gt;
              &lt;AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"&gt;customAttribute&lt;/AttributeValue&gt;
              &lt;ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-    id" MustBePresent="false" DataType="http://www.w3.org/2001/XMLSchema#string"/&gt;
            &lt;/ActionMatch&gt;
          &lt;/Action&gt;
        &lt;/Actions&gt;
      &lt;/Target&gt;    
    &lt;/Rule&gt;
  
    &lt;Rule RuleId="deny-demo100-catch-all" Effect="Permit" /&gt;
  
  &lt;/Policy&gt;
  </code></pre>
  
  <p>(We're using Fedora's XACML implementation).</p>
  
  <p>I'm sure I'm missing something really simple and fundamental here, but cannot figure out what. Could someone point me in the right direction please?</p>