xacml — archive

Re: [xacml] Request and Response Context Schemas - Take 2

From: Anne Anderson <[email protected]>
To: [email protected]
Date: Wed, 05 Jun 2002 16:10:00 -0000

On 5 June, Polar Humenn writes: Re: [xacml] Request and Response Context Schemas - Take 2 > I would really like to get rid of this "multiple" principals concept, and > go with a structured principal. That way the security software can > construct the proper principal. As I said before, I don't think we are ready to define a structured resource. Yes, we could use the relationships described in "A Calculus for Access Control in Distributed Systems" by Abadi, Burrows, Lampson, and Plotkin, but: we don't have a model for how a policy writer should use this structure in writing real policies. For example, do I trust [email protected] to have access to resource X as long as the request asserts that all intermediaries are "quoting" her? Do I trust saguaro.east.sun.com "quoting" java.io.InputStream "speaking for" [email protected]. Theoretically, I think the structure, and maybe the use model, are available, but I think it will take more time than we have right now to incorporate that into XACML. Having multiple role-defined Principals is a way to work around this problem in the meantime, and I, at least, have a clear idea of how that is used in policy statements, since it is the same way PolicyFile is used now. > As for having multiple resources, I disagree. We have to limit the > "request" to something specific, so we aren't doing too much guessing at > the policy end, i.e. at most 1 (structured) principal, 1 resource, 1 > action. I am happy to go with one resource. I think more than one action is probably useful. See above for 1 (structured) principal. Anne -- Anne H. Anderson Email: [email protected] Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692