MHonArc v2.5.0b2 -->
xacml message
[Date Prev]
| [Thread Prev]
| [Thread Next]
| [Date Next]
--
[Date Index]
| [Thread Index]
| [List Home]
Subject: RE: [xacml] request's attribute assertion lifetime?
From: "Daniel Engovatov" <>
To: "Frank Siebenlist" <>
Date: Tue, 9 Mar 2004 10:40:49 -0800
Why should we treat time anyhow differently then any other attribute in
the context? Evaluation happens against the "snapshot" of the context
(or rather a fuzzy snapshot, as we do not regulate how that data will be
cached or provisioned). Time is just a dimension like any other.
After the decision is made - it is PEP job on how and when to use it.
For your example:
You are asking to evaluate not against a point in the context space,
with "current-time" fixed, but against an uncountable set in that space
(current-time from 4 to 6). I do not believe you can formulate such a
query in a generic way. Asking whether you can access at 4, and then at
6 is not sufficient (you can be denied from 17:01 to 17:03)
If you want to test what you can do from 4 to 6, introduce context
parameters "access-begin" "access-end" of type time, and write policy
making use of them. For example
GRANT(enter, building, joe) if access-begin < 2pm and access-end > 5pm.
