Hi Tim, and other XACML-ites.
I thought I would comment on Tim's #6, below, and remark on the
"host" matching, as well. I have probably only studied this
enough to be dangerous, and not enough to add actual value to the
discussion, so if what I say is garbage, then please dispose of
properly, and accept my appology for wasting folks' time. In any
case, here goes ...
> 6. split URLs into three parts: a scheme part for which string-
> match will be used; an authority part for which we will use
> either ipV4Address-match or dnsName-match and a path part
> for which we will use the existing regex-match function.
> IP addresses will be distinguishable from DNS names because
> they begin with a number. Port number will be treated as
> part of the path and, if it is missing, the default port
> number for the scheme will be inserted.
