xacml — archive

[Anne Anderson <anne.anderson@sun.com>]

Here are several changes that I recommend making to the schemas and specification: 1. Schema Request/Subject/KeyInfo currently specified as <xs:complexType name="SubjectType"> <xs:sequence> <xs:choice> <xs:element name="SubjectId" type="xacmlContext:SubjectIdType" minOccurs="0"/> <xs:element ref="ds:KeyInfo"/> Since either is allowed, and since either one is optional, KeyInfo should have minOccurs="0" as follows: <xs:complexType name="SubjectType"> <xs:sequence> <xs:choice> <xs:element name="SubjectId" type="xacmlContext:SubjectIdType" minOccurs="0"/> <xs:element ref="ds:KeyInfo" minOccurs="0"/> 2. Specification Section 4.2.2.1 Target Specify that dynamic construction of "target" from component rules, policies, or policy sets is not mandatory-to-implement. I think the model should be that the XACML PDP engine is presented with a PolicySetStatement or PolicyStatement, and that statement has a Target. The engine evaluates the Request against that Target. How the PolicySetStatement or PolicyStatement is constructed prior to being presented to the XACML PDP engine is completely implementation-dependent. We could proceed to indicate that two possible implementations are ... and ..., but this is outside the scope of the XACML specification. 3. Schema Core/Rule/Target Currently specified as <xs:element name="Target" type="xacml:TargetType" minOccurs="0"/> Now that "any" Target is specified using explicit "anySubject", "anyResource", "anyAction", this should be <xs:element name="Target" type="xacml:TargetType"/> Anne Anderson -- Anne H. Anderson Email: Anne.Anderson@Sun.COM Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692