xacml — archive

[Polar Humenn]

Hi Bill, I think taking a singular evaluation strategy will not work. You need many different combinators to get what you want, and we can make some of them standard. The first and foremost rule/policy combinator I see, is the first determinate decision combinator, which is the easiest to evaluate and the most intuitive, given the worlds familarity with imperative programming. The rules have order, and are listed in order of preference, giving implementers the familiar if-then-else-if-then-else-if... strategy. take-first-decision-and-obligations Takes the first Permit or Deny decision the specified order. Which means for the Combinator T consisting of Policies P1,...,Pn, this combinator T(S,A,R) (where S=subject,A=action,R=resource) returns Indeterminate if all Pi evaluates to Indeterminate for all i, 1<=i<=n. OR, Permit with Qk obligations, where Pi(S,A,R) evaluates to Indeterminate for all i, 1<=i<k<=n, and Pk(S,A,R) evaluates to Permit with Qk obligations, and k<j OR, Deny with Dj obligations, where Pi(S,A,R) evaluates to Indeterminate for all i, 1<=i<j<=n, and Pj(S,A,R) evaluates to Deny with Dj obligations and j<k. I.e. the rule evaluates to either Permit with Qk obligations Deny with Dj obligations Indeterminate. This strategy has the effect of only evaluating the needed policies. Other combinators I fear require evaluating all policies, which is okay, but you have to want it. The only combinator I see much use for is the following, which is the one Bill keeps on about. (All policies must return Permit, (no Denies, no Indeterminates). all-must-permit MUST evaluate *all* policies regardless. If all rules evaluate to Permit gather all their obligations for Permit, but if one rule emits a Indeterminate or a Deny, only the Deny obligations are gathered. For a set of policies P1,...,Pn, this combinator, C(S,A,R) results in Permit with J obligations if for all Pi(S,A,R) evaluates to Permit where J = { Qi | Pi(S,A,R) evaluates to Permit with Qi obligations, for all 1<=i<=n } or, Deny with K obligations if *any* Pi(S,A,R) evaluates to Deny with Di obligations or Indeterminate where K = { Di | Pi(S,A,R) evaluates to onDeny with Di obligations, for all 1<=i<=n } Note, any combinator we invent MUST only evaluate to Permit with Q obligations or Deny with D obligations. Cheers, -Polar