From 3015117fbb09b8bbb4a7b985635af8d1e34e021a Mon Sep 17 00:00:00 2001
From: Nigel Banks <nigel.g.banks@gmail.com>
Date: Wed, 30 Jan 2013 22:07:07 +0100
Subject: [PATCH] Added two more policies, not necessarily required for all
 users.

They both allow access to API-M functions to everyone including
anonymous users.
---
 .../permit-getDatastream-unrestricted.xml     | 25 +++++++++++++++++++
 ...rmit-getDatastreamHistory-unrestricted.xml | 25 +++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 policies/permit-getDatastream-unrestricted.xml
 create mode 100644 policies/permit-getDatastreamHistory-unrestricted.xml

diff --git a/policies/permit-getDatastream-unrestricted.xml b/policies/permit-getDatastream-unrestricted.xml
new file mode 100644
index 00000000..7483cbb3
--- /dev/null
+++ b/policies/permit-getDatastream-unrestricted.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Policy xmlns="urn:oasis:names:tc:xacml:1.0:policy"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       PolicyId="permit-getDatastreamHistory-to-authenticated"
+       RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
+ <Description>Note that other policies may provide exceptions to this broad policy. This policy assumes api-m users have to be authenticated</Description>
+ <Target>
+   <Subjects>
+     <AnySubject/>
+   </Subjects>
+   <Resources>
+     <AnyResource/>
+   </Resources>
+   <Actions>
+     <Action>
+       <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
+         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-getDatastream</AttributeValue>
+         <ActionAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
+           AttributeId="urn:fedora:names:fedora:2.1:action:id"/>
+       </ActionMatch>
+     </Action>
+   </Actions>
+ </Target>
+ <Rule RuleId="1" Effect="Permit"/>
+</Policy>
diff --git a/policies/permit-getDatastreamHistory-unrestricted.xml b/policies/permit-getDatastreamHistory-unrestricted.xml
new file mode 100644
index 00000000..f7662eb0
--- /dev/null
+++ b/policies/permit-getDatastreamHistory-unrestricted.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Policy xmlns="urn:oasis:names:tc:xacml:1.0:policy"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       PolicyId="permit-getDatastreamHistory-to-authenticated"
+       RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
+ <Description>Note that other policies may provide exceptions to this broad policy. This policy assumes api-m users have to be authenticated</Description>
+ <Target>
+   <Subjects>
+     <AnySubject/>
+   </Subjects>
+   <Resources>
+     <AnyResource/>
+   </Resources>
+   <Actions>
+     <Action>
+       <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
+         <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:fedora:names:fedora:2.1:action:id-getDatastreamHistory</AttributeValue>
+         <ActionAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"
+				    AttributeId="urn:fedora:names:fedora:2.1:action:id"/>
+       </ActionMatch>
+     </Action>
+   </Actions>
+ </Target>
+ <Rule RuleId="1" Effect="Permit"/>
+</Policy>