Subject:
 There can be one or more Subject elements, and each can be identified by a category URI.
Resource:
 XACML 1.0/1.1 must have exactly one Resource element in a request; XACML 2.0 may have more than one Resource element.
Action:
 There must be exactly one Action element in a request.
Environment:
 XACML 2.0 must have exactly one Environment element, while earlier versions can have 0 or 1 Environment element.

Do one of the following:
To add the assertion to the Policy Development window, see Add an Assertion.
To change the configuration of an existing assertion, proceed to step 2 below.
When adding the assertion, the XACML Request Properties automatically appear; when modifying the assertion, right-click 
Create XACML Request 
in the policy window and select 
XACML Request Properties
 or double-click the assertion in the policy window. The assertion properties are displayed. 
Complete the basic settings for the Request:
XACML Version:
 Choose the XACML version that the generated XACML request will use. The options are: 
1.0
, 
1.1
, and 
2.0
. (Note: The chosen version may affect the availability of certain options when building the request.)
SOAP Encapsulation:
 Choose the version of SOAP to use for encapsulation:
SOAP 1.1
: The XACML <Request> element is contained in the Body element of a SOAP 1.1 envelope.
SOAP 1.2: 
The XACML <Request> element is contained in the Body element of a SOAP 1.2 envelope.
None
: The XACML request is not enclosed in a SOAP envelope. The Evaluate XACML Policy assertion will not need to remove the SOAP envelope in order to use it.
Message Output:
 Choose where to place the resulting XACML request: In the 
Request
, 
Response
, or a 
Message Variable
 (context variable of type Message). If you choose to place it in a Message Variable, the variable does not need to exist beforehand—it will be created by this assertion. Do not enclose the variable with the "${ }" characters. 
Configure each node as appropriate:
Subject
Resource
Action
Environment
Context variables can be used in many settings when configuring a node. If during policy execution a referenced variable does not exist, the service policy will fail and a warning will be logged.
Click [
OK
]
 
when done.

To add a new Subject node, right-click on the Request root node and then select 
Add Subject
.
To remove an existing Subject node, right-click on the Subject node and then select 
Remove Subject
. You cannot remove the last Subject node in a Request.

Subject Category:
 This attribute describes the role that the Subject element plays in making the access request. If more than one Subject has the same Subject Category, then the Evaluate XACML Policy assertion will treat the contents of those Subject elements as if they were contained in the same Subject element.

To add a new Resource node, right-click on the Request root node and then select 
Add Resource
.
To remove an existing Resource node, right-click on the Resource node and then select 
Remove Resource
. You cannot remove the last Resource node in a Request.

To remove an Environment element from a XACML 1.0 or 1.1 request, right-click on the Environment node and then select 
Remove Environment
.

To add an Attribute node, right-click a major node and then select 
Add Attribute
.
To remove an Attribute node, right-click the node and then select 
Remove Attribute
.

AttributeID:
 The AttributeId. Enter the value for the AttributeId or select from the drop-down list. This field is required. 
DataType:
 The data type of the contents of the <AttributeValue> element. Enter the Data Type or select from the drop-down list. This field is required. 
Issuer:
 This attribute specifies the Issuer. This field is optional. 
IssueInstant
 (XACML 1.0 and 1.1 only): The date and time at which the attribute was issued. The Issue Instant must be one of the following: 
blank
A context variable that resolves to a valid timestamp, either using one of the built-in variables 
gateway.time.local, gateway.time.utc, request.time.local, request.time.utc,
 or a user-defined variable that contains a timestamp.
A manually entered date/time in the format: yyyy-MM-dd'T'HH:mm:ss[Z], where 'T' is a separator character and '[Z]' is the required time zone. 

To add an AttributeValue node, right-click an Attribute node and then select 
Add Attribute Value
. Note that the number of AttributeValue nodes permitted depends on the version of XACML used (see above).

To remove an AttributeValue from an Attribute, right-click the AttributeValue node and then select 
Remove Attribute Value.

         <AttributeValue ID1="VALUE1">CONTENT1</AttributeValue>         <AttributeValue ID2="VALUE2">CONTENT2</AttributeValue>

A 
single-value variable
 will be treated the same as static text: it will be repeated for each <AttributeValue> generated. For example:

   <AttributeValue ID1="STATIC_VALUE">CONTENT1</AttributeValue>          
   <AttributeValue ID2="STATIC_VALUE">CONTENT2</AttributeValue>   

A 
multivalued context variable containing a single value
 will behave as expected: its single value becomes the limiting factor in the number of <AttributeValue> elements created.

To add an Multiple Attribute node, right-click a major node and then select 
Add Multiple Attributes
.
To remove an Multiple Attribute node, right-click the node and then select 
Remove Multiple Attributes
.

If any of the 
AttributeID
, 
DataType
, 
IssueInstant
, or 
Issuer
 fields is of type 'Context Variable' 
and
 a multivalued context variable is entered.
If any of the 
AttributeID
, 
DataType
, 
IssueInstant
, 
Issuer
, or 
AttributeValue
 fields is of type 'Relative XPath' 
and
 the 
XPath Base
 evaluates to a multi-node result.

To add a ResourceContent node, right-click the Resource node and then select 
Add Resource Content
.
To remove the ResourceContent node, right-click the node and then select 
Remove Resource Content
.