xacml — archive

[Anne Anderson <anne.anderson@sun.com>]

PM-1-?: how NOT-APPLICABLE impacts a combinator expression A combinator expression is a combination of predicates, where possible combinators are <AND>, <OR>, <NOT>, <N-OF>, <ORDERED-[AND OR N-OF]>. This list of Combinators can be extended. Example: <AND> predicate1, predicate2, predicate3 </AND> The issue occurs when one or more of the predicates in the list returns a result of NOT-APPLICABLE (this can occur if the predicate is a <referencedPolicy>). What should the result of the combinator expression be? What if ALL predicates in the bominator expression return NOT-APPLICABLE? Potential Resolution: a) Any predicate evaluating to NOT-APPLICABLE is logically removed from the combinator expression. Example: if predicate3 in the example above returned a result of NOT-APPLICABLE, then the combinator expression is the result of <AND> predicate1, predicate2 <AND> b) An empty combinator expression has the following results: <AND></AND> -> TRUE <OR></OR> -> FALSE <NOT></NOT> -> TRUE <N-OF></N-OF> -> FALSE <ORDERED-[whatever]> has same result as [whatever] above. Extended combinators must define the result of an empty expression. Example: If predicates 1, 2, and 3 in the example above all evaluate to NOT-APPLICABLE, then the combinator expression is <AND></AND>, and the result is TRUE. b)-alternative: An empty combinator expression has a result of NOT-APPLICABLE. Champion: Anne -- Anne H. Anderson Email: Anne.Anderson@Sun.COM Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692