xacml — archive

[Erik Rissanen]

All, Issue 72 is about where policies supplied in a SAML XACMLAuthz request should be placed among the other policies of the PDP. The difficulty of this issue is that XACML currently does not say anything about how a PDP finds it "contained policies" in the first place. Without a specification for this, there is nothing to relate the SAML supplied policies to. I don't think we should specify policy finding in the PDP, so I propose that we leave this unspecified. Different users/PDPs may find different modes of operation useful. I propose that we add the following text to the SAML profile regarding this issue: --8<-- Since XACML does not specify how a PDP selects a policy to evaluate, the supplied policies are related to the policies already available in the PDP in an implementation specific manner. For example, a PDP MAY treat the policies in the same manner as other policies in the PDP, it MAY choose to insert the supplied policies in a PolicySet at some specified point, it MAY use solely the supplied policies or it MAY make use of the supplied policies in some other way. Users of a PDP should coordinate with the providers of the PDP to establish meaningful behavior for the supplied policies. --8<-- Best regards, Erik