Title: RE: [xacml] [policy-model] A Proposal
Tim,
I
think that 'not' does not substitute for 'deny'. From my point of view 'not' is
just a logical operation.
You
can have 'not' condition in the grant statement and it may or may not fire.
If 'not' something evaluates to false
you do
not get a 'grant'. 'Deny' on the other hand has implications for role
hierarchies and also can have 'not' conditions imbedded
in it.
I agree with Michiharu that it is better to have explicit 'grant' and 'deny' (or
some variation thereof)
Simon
G.
-----Original Message-----
From: Tim Moses
[mailto:]
Sent: Monday, December 03, 2001 11:20
AM
To: xacml
Subject: RE: [xacml] [policy-model] A
Proposal
Michiharu - Thanks for this proposal on extensibility. I
suspect that we will delay discussion of extensibility points until the model
is settled. However, it will become important at that time.
In the model, as currently described, we do not include
separate elements for "grant" and "deny". Instead, the "deny" semantics
are provided by "and" and "not" ...
<and>
<predicate>grant_condition</predicate>
<not>
<predicate>deny_condition></predicate>
</not>
</and>
With this approach, no explicit grant element is required: if
the applicable policy evaluates TRUE, then the PDP may return the saml
"permit" status code.
All the best. Tim.
-----------------------------------------
Tim Moses
Tel: 613.270.3183
-----Original Message-----
From:
Michiharu Kudoh [mailto:]
Sent: Monday, December 03, 2001 7:24 AM
To:
xacml
Subject: [xacml] [policy-model] A
Proposal
I drew a picture about the desirable extensibility of XACML
policy model
based on the currently proposed XACML
language document.
(See attached file: ModelProposal.ppt)(See attached
file:
ModelProposal.pdf)
Best regards,
Michiharu Kudo
