Re: XACML and RBAC. Forwarded message from Gerald Brose.

1. Standard "role" attribute"

Gerald Brose makes a case for our defining a standard subject
"role" attribute.  He has persuaded me that this is a good idea.
Our interchange is attached.

Here is a concrete proposal:
Add following to Appendix B.5 "Subject attributes":

  This identifier indicates a role associated with the subject.
  Values of this attribute SHOULD be of type
  "http://www.w3.org/2001/XMLSchema#anyURI".

    urn:oasis:names:tc:xacml:2.0:subject:role

2. Standardize "RBAC Profile"

I would also like to move our RBAC Profile
(http://www.oasis-open.org/committees/download.php/2405/wd-xacml-rbac-profile-01.doc)
to Committee Draft status.  As of the last meetings with the NIST
RBAC people, the only objections were that we should add a
section on administrative policies.  The spec already has a basic
section on administrative policies (i.e. have the role-assigning
or role-enabling entity use its own XACML policies).  I believe
anything more elaborate depends on the resolution of our XACML
2.0 administration of policies issues.

Any objections to putting discussion of the status of the RBAC
profile on the agenda for the 22nd, and, if no objections,
scheduling a Committee Draft vote for Feb 5?

-Anne