xacml — archive

RE: [xacml] Groups - Changes Since XACML 1.0 (xacml_1.x_2.0_diffs_draft.doc) uploaded

From: Daniel Engovatov <[email protected]>
To: [email protected]
Date: Thu, 23 Jun 2005 21:27:00 -0000

 MHonArc v2.5.0b2 -->
















xacml message






[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]








Subject: RE: [xacml] Groups - Changes Since XACML 1.0 (xacml_1.x_2.0_diffs_draft.doc) uploaded




From: "Daniel Engovatov" <[email protected]>
To: <[email protected]>
Date: Thu, 23 Jun 2005 14:27:03 -0700







>Could you clarify what you mean by "policy recombination algorithms"?
>Is this just another term for "policy combining algorithms"?  Could you
>give a concrete example of how XQuery would be used to express
something
>like Deny-Overrides?


Yes, sorry for the incorrect term.

XQuery may be used to define a particular algorithm in the following
way:

We define an element type for a result of a rule. Trivial example (real
schema should include all parameters etc):

<ruleresult><effect>DENY</effect></ruleresult>

We define schema for the policy result, something like:
<policyresult>PERMIT</policyresult>


Then we require to express the recombination algorithm as an XQuery
function taking a sequence of <ruleresult> elements (and whatever else
needed, including, possibly a reference to the request document) and
returning a <policyresult> (Not correct, just a rough example)

declare function xacml:deny-or-permit($rr as
schema-element(xacml:ruleresult)*) as schema-element(xacml:policyresult)
{
  <policyresult>
      {
       (: whatever logic is required to determine what to return, like
:)
       
        if (fn:empty($rr[effect eq "DENY"])) then "PERMIT" else "DENY"

      }
  </policyresult>
};

Obviously, any implementation of such an algorithm does not need to
actually created XML document and run an XQuery processor, but using
such a general purpose language may allow for interoperability of custom
recombination algorithms.

Just a thought - maybe we can briefly discuss that at a focus group or
over e-mail.

Daniel;
















[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]