Balana: Root policy with issuer is treated like a trusted policy - wso2

Question

I implemented the wso2 Balana PDP.
I have a simple policy issued by Bob giving subject Alice permission. When I evaluate a request from Alice the implementation returns a Permit even though there is no trusted policy (I assumed it should return NotApplicable).
As far as I understand there needs to be at least one policy without issuer as the root of the reduction graph (OASIS Specification).
Do I need to implement the policy finder differently or did I misunderstand the administration concept?
This is the PDP code:
package xacmlimplementation.wso2;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.ArrayList;
import java.util.HashSet;
import java.util.Iterator;
import java.util.NoSuchElementException;
import java.util.Set;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import org.w3c.dom.Document;
import org.wso2.balana.Balana;
import org.wso2.balana.PDP;
import org.wso2.balana.PDPConfig;
import org.wso2.balana.ParsingException;
import org.wso2.balana.combine.PolicyCombiningAlgorithm;
import org.wso2.balana.combine.xacml2.FirstApplicablePolicyAlg;
import org.wso2.balana.ctx.AbstractResult;
import org.wso2.balana.ctx.ResponseCtx;
import org.wso2.balana.finder.AttributeFinderModule;
import org.wso2.balana.finder.PolicyFinder;
import org.wso2.balana.finder.PolicyFinderModule;
import org.wso2.balana.finder.impl.FileBasedPolicyFinderModule;
import org.xml.sax.SAXException;
import xacmlimplementation.engine.XacmlResult;
import xacmlimplementation.engine.XacmlResult.Decision;
import xacmlimplementation.engine.XacmlResult.ErrorType;
public class TestBalana {
public static void main(String[] args) {
Set<String> policyLocations = new HashSet<String>();
policyLocations.add("/path/to/policy.xml");
String request = "/path/to/request.xml";
// create default instance of Balana
Balana balana = Balana.getInstance();
// Default PDP config
PDPConfig pdpConfig = balana.getPdpConfig();
// Set up policy finder
PolicyCombiningAlgorithm wso2Alg = new FirstApplicablePolicyAlg();
PolicyFinder policyFinder = new PolicyFinder();
Set<PolicyFinderModule> policyFinderModules = new HashSet<PolicyFinderModule>();
// module for the root policies
// FileBasedPolicyFinderModule uses DenyOverrides
PolicyFinderModule policyModule = new FileBasedPolicyFinderModule(policyLocations);
policyFinderModules.add(policyModule);
policyFinder.setModules(policyFinderModules);
PDP pdp = new PDP(new PDPConfig(pdpConfig.getAttributeFinder(), policyFinder, null));
String requestString = null;
try {
Path p = Paths.get(request);
byte[] content = java.nio.file.Files.readAllBytes(p);
requestString = new String(content);
} catch (IOException e) {
System.out.println("Error reading "+request);
return;
}
String response = pdp.evaluate(requestString);
ResponseCtx responseCtx = null;
ByteArrayInputStream inputStream = null;
AbstractResult result = null;
try {
DocumentBuilderFactory dbf;
Document doc;
inputStream = new ByteArrayInputStream(response.getBytes());
dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
doc = dbf.newDocumentBuilder().parse(inputStream);
responseCtx = ResponseCtx.getInstance(doc.getDocumentElement());
Iterator<AbstractResult> it = responseCtx.getResults().iterator();
result = it.next();
} catch (ParsingException e) {
System.out.println("Error parsing xacml response: " + e.getMessage());
e.printStackTrace();
return;
} catch (NoSuchElementException e) {
System.out.println("Result list is empty");
e.printStackTrace();
return;
} catch (SAXException e) {
System.out.println(e);
e.printStackTrace();
return;
} catch (IOException e) {
System.out.println(e);
e.printStackTrace();
return;
} catch (ParserConfigurationException e) {
System.out.println(e);
e.printStackTrace();
return;
}
try {
inputStream.close();
} catch (IOException e) {
System.err.println("Error in closing input stream of XACML response");
return;
}
//System.out.println(result.encode());
switch (result.getDecision()) {
case AbstractResult.DECISION_PERMIT:
System.out.println("Permit");
break;
case AbstractResult.DECISION_DENY:
System.out.println("Deny");
break;
case AbstractResult.DECISION_NOT_APPLICABLE:
System.out.println("NotApplicable");
break;
case AbstractResult.DECISION_INDETERMINATE:
case AbstractResult.DECISION_INDETERMINATE_PERMIT:
case AbstractResult.DECISION_INDETERMINATE_DENY:
case AbstractResult.DECISION_INDETERMINATE_DENY_OR_PERMIT:
System.out.println("Indeterminate");
break;
default:
System.out.println("Decision doesn't match Permit, Deny, NotApplicable, ...");
break;
}
}
}
The policy:
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<PolicySet xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:permit-overrides" PolicySetId="PolicySet1" Version="1.0">
<Target/>
<Policy PolicyId="PolicyBobGrantsAliceAccess" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides" Version="1.0">
<PolicyIssuer>
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" IncludeInResult="true">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Bob</AttributeValue>
</Attribute>
</PolicyIssuer>
<Target>
<AnyOf>
<AllOf>
<Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Alice</AttributeValue>
<AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
</Match>
</AllOf>
</AnyOf>
</Target>
<Rule Effect="Permit" RuleId="Rule1">
<Target/>
</Rule>
</Policy>
</PolicySet>
The request:
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false">
<Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" IncludeInResult="false">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Alice</AttributeValue>
</Attribute>
</Attributes>
</Request>