Another OAM 10g policy evaluation question

Question

I have a policy with authz expression= Rule A & Rule B & Rule C:
Rule A:
Allow: ldap_attr_1 = X
Deny: no one is denied
Allow preceeds denial: true
Authz failure redirection URL: URL1
Rule B:
Allow: ldap_attr_2 = Y
Deny: no one is denied
Allow preceeds denial: true
Authz failure redirection URL: URL1
Rule C:
Allow: anyone is allowed
Deny: ldap_attr_3 = Z
Allow preceeds denial: false
Authz failure redirection URL: URL2
My user profile has ldap_attr_1=X, ldap_attr_2=Y, ldap_attr_3=Z, I expect access to be denied based on Rule C and user redirected to URL2. Instead I see authorization = Inconclusive and Rule=<not found>.
If user has ldap_attr_1=X, ldap_attr_2=Y and NOT ldap_attr_3=Z I am getting correct evaluation - user is authorized.
Any ideas how to make this working? Basically I want user to be redirected to the URL that is defined in the rule that caused denial.
Thanks,
Alex

Answer 1

Hi Colin,
Here's what I have:
Authz Rule: Rule1
Access allowed: Any one
Access denied: ldap rule (attr=value)
Allow takes precedence: false
Actions: redirect to URL1 on denied
You can use any attribute and any value, i am using my custom attribute. Then I protect a resource /myresource with policy Policy1 that only has this rule. Set up attr=value and access tester shows redirection to URL1. Now 2 more rules:
Authz Rule: Rule2
Access allowed: ldap rule (o=org)
Access denied: no one is denied
Allow takes precedence: true
Actions: no actions
Authz Rule: Rule3
Access allowed: ldap rule (title=title)
Access denied: no one is denied
Allow takes precedence: true
Actions: no actions
And Policy2 has authz expression Rule2 AND Rule3 AND Rule1. And Policy2 has action: redirect on authorization inconclusive to URL2. My user's profile has o=org, title=title, attr=value. Access tester shows redirection to URL2.
Thanks,
Alex