xacml — archive

[Polar Humenn <polar@syr.edu>]

 MHonArc v2.5.0b2 -->

















xacml message






[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]








Subject: RE: [xacml] Proposal on item 7 ConditionReference




From: Polar Humenn <polar@syr.edu>
To: Daniel Engovatov <dengovatov@bea.com>
Date: Wed, 3 Dec 2003 20:33:28 -0500 (EST)






On Wed, 3 Dec 2003, Daniel Engovatov wrote:

> But shouldn't the LET statement be evaluated as a part of context, not
> within a particular policy?

I don't understand. The LET statement evaluates expressions against the request context
within a policy evaluation, just as if the expressions were explicitly
repeated within the rules.

> I think that is one more case for having the third schema.  We have
> <request> - with data pertinent to the individual query, <policy>, and
> we can use <context> schema for a document relevant to all policies
> evaluation. A place to declare named attributes and types, there
> location/source information, functions, that PDP is supposed to
> understand, and now this LET statement equivalent, for dynamic
> expression that are to be computed once and used for all policies
> evaluations.

I think I know where you are going with this, but I don't think the LET
statement will do that for you. What we want is to simply reference values
amongst different rules.

Cheers,
-Polar

> For example a place to define five-minutes-from-now attribute of
> datetime type defined as (add-time current-time 5 minutes) and so on.
>
>
> Daniel;
>
>