xacml — archive

[System]

Just so we are clear, I think the issue we are discussing is whether a PDP should share information about the basis for an authorization decision, in addition to they actual decision. It seems clear that the actual decision will be made known to both the PDP and the subject. If that is not what we are debating, would someone please tell me. I think this problem needs to be partitioned into at least 4 cells. First, there is the case of access allowed and access denied. I can imagine why someone might not want to share the reasons for denial, but it is harder to understand in the case of access allowed. Second, the question can be divided between informing the PEP and informing other parties, in particular the subject. Again informing the PEP, which is a trusted party, seems harmless. When access is allowed, this is the case where some SAML people want this information for future audit purposes. Where access is denied, the PEP may be able to correct the condition, for example by letting the subject re-authenticate by a different method. Informing the subject is not a SAML requirement and I can't think of any valid reason for it. However, to argue we can't tell the PEP because the information might leak seems a little like saying we have to execute people because we are too incompetent to keep them in prison. In summary here are the four cells as I see them: Allowed Denied ---------------------------------------------------------------------------- ---------- Inform PEP SAML Requirement Useful if condition can be changed ---------------------------------------------------------------------------- ---------- Inform Subject Harmless Possibly Risky ---------------------------------------------------------------------------- ----------- Hal >