xacml — archive

[Anne Anderson <anne.anderson@sun.com>]

I propose that an <applicablePolicy> be the unit of evaluation. It consists of the following basic elements: <applicablePolicy> <subject> optional simple R.E. that subject must match </subject> <resource> optional simple R.E. that resource must match </resource> <action> optional simple R.E. that action must match </action> <additionalConditions>[optional arbitrary boolean expression]</addtionalConditions> <policy> [arbitrary combinator expression that can reference other applicablePolicies] </policy> </applicablePolicy> A referencedPolicy is evaluated as follows: 1. If <subject> condition exists, evaluate it. If false, return not-applicable . If error (should not occur), return error . 2. If <resource> condition exists, evaluate it. If false, return not-applicable . If error (should not occur), return error . 3. If <action> condition exists, evaluate it. If false, return not-applicable . If error (should not occur), return error . 4. If <additionalConditions> exist, evaluate them. If result is not true, return result. 5. Evaluate policy. Return result. Vendors that want to index policies can index on the <subject>, <resource>, or <action> (or more than one) element. A missing <subject> element means potentially applies to all subjects , etc. Simon's rules can be expressed using this syntax. To make the combinator expression semantics clear, I propose we use combinator attributes such as <AND not-applicable=ignore error=false> where the options for not-applicable or error are ignore , true , false , propagate , error , or not-applicable . Ignore means eliminate any not-applicable referenced policies from the expression before evaluating. Propagate means if a not-applicable or error is encountered, then the result of the entire combinator expression immediately becomes not-applicable or error . not-applicable=error means treat a not-applicable referencedpolicy as an error. error=not-applicable means treat a referencedPolicy that returns error as not-applicable. I don't think all combinations of attribute values are very meaningful, but we would know how to evaluate. -- Anne H. Anderson Email: Anne.Anderson@Sun.COM Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692