<?xml version="1.0" encoding="UTF-8"?>
<PolicySet
xmlns="http://www.rubix.com/2008/RXSPMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.rubix.com/2008/RXSPMLSchema ../common-scripts/RXSPMLSchema.xsd"
PolicySetId="ip-user-table"
PolicyCombiningAlgId="ordered-permit-overrides">
	<Description>
		Policy for any operation on the user table.
		Allow op only if from allowed IP address as configured in policy_data_tab.
		If a row in policy_data_tab has table_name column equal to the user table name
		then the corresponding value of the ip-address column 
		specifies an allowed IP address for the user table.
		Deny all others.
	</Description>
	<Target/>
	
	<Policy PolicyId="user-table-ip-list" RuleCombiningAlgId="ordered-permit-overrides">
		<Target/>
		<Rule RuleId="ip-list-rule" Effect="Permit"><Target/>
		<Condition>
			<Apply FunctionId="is-in">
				<SubjectAttributeDesignator AttributeId="ip-address"/>
				<ImportColumnSelector RequestContextPath="db.policy_data_cat.policy_data_sch.policy_data_tab.ip_address" DataType="ipAddress">
      		<Apply FunctionId="equal">
        		<ImportFieldSelector RequestContextPath="db.policy_data_cat.policy_data_sch.policy_data_tab.table_name" DataType="string"/>
						<ResourceAttributeDesignator AttributeId="table-name"/>
					</Apply>
				</ImportColumnSelector>
			</Apply>
		</Condition></Rule>
	</Policy>
		
	<PolicyIdReference>deny</PolicyIdReference>
		 
</PolicySet>
