On 4 November, Polar Humenn writes: Re: [xacml] subjects
> I think a better more workable solution would be to make the subjects
> (i.e. lists of attributes) unique to the category, and use the present
> SubjectAttributeDesignator (with the SubjectCategory part) and get rid of
> the SubjectAttributeDesignatorWhere. That's simple and I think everybody
> can get their brains wrapped around that.
I can live with this. What we lose is the ability to associate
attribute values with the identities and authentication methods
under which those attributes were issued. We can continue to try
to improve this for 1.1 or 2.0. I really think we are going to
need some serious thought to solve the problems raised by
SADWhere, and I would rather have a good solution than a complex,
understudied, possibly unworkable one.
Anne
--
Anne H. Anderson Email:
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311 Tel: 781/442-0928
Burlington, MA 01803-0902 USA Fax: 781/442-1692
