OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

xacml message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]

Subject: RE: XACML TC Charter Revision - Strawman

Hal, your response to a) below would seem to indicate that you believe one
or more of the following:

1. providing all information would require too much space
2. an iterative conversation between an PEP, PDP, and Attribute Authority
would require too much time

Is this the case?

It is also not clear to me the a) would require unnecessary authentication

Note, the only way a PEP could provide all information necessary to make a
decision without an iterative conversation would be if the PEP had a way of
finding out the finite set of attributes referenced by all policies used to
provision the PDP or the finite set of attributes available from the
attribute authority. Perhaps we are making the same point here Hal?

(a) require each request to contain all information necessary 
> > to form a
> > decision
> 
> I don't think (a) is a practical possibility. It either 
> requires the PEP to
> understand the policies that apply (which seems an undesirable lack of
> encapsulation) or for the PEP to provide all possible 
> evidence with every
> request. I don't think this is feasible from a performance 
> standpoint in a
> distributed environment. It also leads to behavior which is 
> unacceptable
> from a user's point of view, for example, requiring unnecessary
> Authentication.

> 

                                                

					
                                                    

        
                                                
				

                                                

                                                    
                                                

                                                
                                            
                                        

                                        
                                        

                                    
			

                                    
                                

                                
                                

                                

                            
		
                
        
    




            
        
    


	



    

         
    
Related Content