On 27 July, Tim Moses writes: RE: [xacml] Section B.6 - Resource attributes
> 1. "In the former case, the attribute identifier SHALL appear in the
> ResourceAttributeDesignator> element."
>
> I only included this sentence as a counterpart to the earlier sentence: "The
> corresponding attributes MAY appear in the <Resource> element of the request
> context". You are right; it's redundant. I'll take it out.
>
> 2. OK. I'll remove any restriction on the type of resource-id.
>
> 3. I'll drop the xpath attribute.
>
> 4. I'll add the document-id attribute. Can we say anything about this
> attribute and what it might contain?
The document-id attribute is defined in the Hierarchical
Resources Profile. It will be included in Section 6 "New
attribute identifiers for hierarchical resources", but is
currently only defined Section 3.1 "Notes in an XML document"
after the "Additional attributes MAY be included ..." paragraph.
I don't know if we want to define this also in the core XACML
spec.
> How about this? ...
>
> Draft 13
>
> These identifiers indicate attributes of the resource. The corresponding
> attributes MAY appear in the <Resource> element of the request context and
> be accessed by means of a <ResourceAttributeDesignator> element, or by an
> <AttributeSelector> element that points into the <Resource> element of the
> request context.
> This attribute identifies the contents of the
> <xacml-context:ResourceContent> element.
> urn:oasis:names:tc:xacml:1.0:resource:document-id
The Hierarchical resources profile says the following:
The <AttributeValue> of this <Attribute> SHALL be a URI that
identifies the XML document of which the requested resource is
a part. This <Attribute> MAY specify an Issuer.
If you also define document-id in the core spec, then I think it
should mention that the DataType SHALL be &xml;anyURI.
> This attribute identifies the resource to which access is requested. Note:
> the resource to which access is requested may not be the same as the
> resource supplied in the <xacml-context:ResourceContent>
element.
I think I would say something like, "If an
<xacml-context:ResourceContent> element is provided, then the
resource to which access is requested SHALL be all or a portion
of the resource supplied in the <xacml-context:ResourceContent>
element."
Anne
> urn:oasis:names:tc:xacml:1.0:resource:resource-id
> This attribute identifies the namespace of the top element of the contents
> of the <xacml-context:ResourceContent> element. In the case where the
> resource content is supplied in the request context and the resource
> namespace is defined in the resource, the PDP SHALL confirm that the
> namespace defined by this attribute is the same as that defined in the
> resource. The type of the corresponding attribute SHALL be
> "http://www.w3.org/2001/XMLSchema#anyURI".
> urn:oasis:names:tc:xacml:2.0:resource:target-namespace
>
>
>
>
> -----Original Message-----
> From: Anne Anderson [mailto:]
> Sent: Tuesday, July 27, 2004 11:26 AM
> To: Tim Moses
> Cc: 'XACML'
> Subject: Re: [xacml] Section B.6 - Resource attributes
>
>
> On 27 July, Tim Moses writes: [xacml] Section B.6 - Resource attributes >
> Colleagues - Some proposed changes to Section B.6. Any comments? All the
> > best. Tim. >
> > Draft 13
> >
> > These identifiers indicate attributes of the resource. The corresponding
> > attributes MAY appear in the <Resource> element of the request context and
> > be accessed by means of a <ResourceAttributeDesignator> element, or by an
> > <AttributeSelector> element that points into the <Resource> element of the
> > request context. In the former case, the attribute identifier SHALL
> appear > in the <ResourceAttributeDesignator> element.
>
> I don't understand why the last sentence is needed. If the attribute is in
> the <Resource> element and is accessed by means of a
> <ResourceAttributeDesignator> element, doesn't that mean the attribute
> identifier must by definition appear in the <ResourceAttributeDesignator>
> element?
>
> > This identifier indicates the URI of the resource. The type of the >
> corresponding attribute SHALL be "http://www.w3.org/2001/XMLSchema#anyURI".
> > urn:oasis:names:tc:xacml:1.0:resource:resource-id
>
> The Hierarchical Resource Profile for XML resources proposes that the
> DataType of the resource-id be "xpath-expression", identifying the specific
> node of the resource that is being requested. In this case, the optional
> "document-id" resource Attribute can be used to hold the URI of the entire
> XML document.
>
> I think Daniel also objected to forcing resource-id to be a URI. Or maybe it
> was just a URI conforming to my proposed hierarchical URI scheme :-)
>
> So is there a reason resource-id must be a URI?
>
> > This identifier indicates the name-space of the top element of the
> resource. > In the case where the resource content is supplied in the
> request context > and the resource namespace is defined in the resource,
> the PDP SHALL confirm > that the namespace defined by this attribute is the
> same as that defined in > the resource. The type of the corresponding
> attribute SHALL be > "http://www.w3.org/2001/XMLSchema#anyURI".
> > urn:oasis:names:tc:xacml:2.0:resource:target-namespace
>
> > This identifier indicates an xpath expression whose context node is the
> > <xacml-context:Request> element. This attribute SHALL only appear in the
> > <ResourceAttributeDesignator> element. The type of the corresponding >
> attribute SHALL be >
> "urn:oasis:names:tc:xacml:2.0:data-type:xpath-expression".
> > urn:oasis:names:tc:xacml:2.0:resource:xpath
>
> I proposed that we drop the "xpath" Attribute, since there is no need for it
> with the Hierarchical Resource Profile. "resource-id" in that case will
> contain the xpath expression pointing to the requested node.
>
> Note that the reason for putting the xpath-expression pointing to the
> requested node into the "resource-id" Attribute is so that the Response
> <Result> ResourceId XML attribute can copy the resource-id Attribute and
> have it be an unambiguous reference to the node to which the <Result>
> corresponds.
>
> Anne
> --
> Anne H. Anderson Email:
> Sun Microsystems Laboratories
> 1 Network Drive,UBUR02-311 Tel: 781/442-0928
> Burlington, MA 01803-0902 USA Fax: 781/442-1692
--
Anne H. Anderson Email:
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311 Tel: 781/442-0928
Burlington, MA 01803-0902 USA Fax: 781/442-1692
