xacml — archive

[Anne Anderson <anne.anderson@sun.com>]

All <Subject> elements WITH THE SAME SUBJECT CATEGORY are assumed to be the same entity. I.e. all "access-subject" <Subject>s are the same entity, all "codebase" <Subject>s are the same entity, etc. I don't think this is a very strong requirement, and especially for "intermediary-subject", there could certainly be more than one entity involved. Anne On 5 September, Polar Humenn writes: Re: [xacml] multiple subjects clarification > From: Polar Humenn <polar@syr.edu> > To: Anne Anderson <Anne.Anderson@sun.com> > Subject: Re: [xacml] multiple subjects clarification > Date: Thu, 5 Sep 2002 09:39:06 -0400 (EDT) > > On Thu, 5 Sep 2002, Anne Anderson wrote: > > > On 4 September, Simon Godik writes: [xacml] mulitple subjects clarification > > > Ann, I would like to get clarification for mulitple subjects semantics. > > > > > > 1. There may be more than 1 <subject> of the same category in the request context. > > > true:false > > > > True. All <Subject> elements with the same subject category are > > assumed to be the same entity, but each different <Subject> block > > may be used to encapsulate all attributes issued to that entity > > under one of its various names. > > Is it really the case that *all* subject elements are required to be the > same entity? I thought there were different principals, and in different > "types", such as "codebase", and third party principals, not to mention > intermediaries. > > -Polar > > > > > > > > 2. Sequence of <SubjectMatch>'es under //Target/Subject refers to one and only one <subject> element in the request context. > > > true:false > > > > It depends on whether the sequence of <SubjectMatch>s narrows > > down the //Target/Subject to a single <Subject> element in the > > request context. > > > > Example Context: > > > > <Subject> > > <Attribute > > AttributeId="identifier:subject:subject-id"> > > <AttributeValue > > DataType="identifier:datatype:rfc822name">jhibbert@medico.com</AttributeValue> > > </Attribute> > > <Attribute > > AttributeId="identifier:subject:role"> > > <AttributeValue>physician</AttributeValue> > > </Attribute> > > </Subject> > > <Subject> > > <Attribute > > AttributeId="identifier:subject:subject-id"> > > <AttributeValue > > DataType="identifier:datatype:x500name">cn=Julius > > Hibbert,o=Medico Corp,c=us</AttributeValue> > > </Attribute> > > <Attribute > > AttributeId="identifier:subject:role"> > > <AttributeValue>physician</AttributeValue> > > </Attribute> > > </Subject> > > > > Now the following <Target>: > > > > <Target> > > <Subjects> > > <Subject> > > <SubjectMatch > > MatchId="function:string-match"> > > <SubjectAttributeDesignator > > AttributeId="identifier:subject:role" > > DataType="xs:string"/> > > <AttributeValue > > DataType="xs:string">physician</AttributeValue> > > </SubjectMatch> > > </Subject> > > </Subjects> > > ... > > </Target> > > > > will match both the above context <Subject> elements. > > > > Is this a problem? > > > > > 3. If subject-match is satisfied by some <subject> element in the request context, does it mean that > > > subject-designator in the condition portion of the rule must be satisfied with the same <subject> element? > > > > No. I don't see why it should. And I don't see any problems if > > it does. > > > > Anne > > -- > > Anne H. Anderson Email: Anne.Anderson@Sun.COM > > Sun Microsystems Laboratories > > 1 Network Drive,UBUR02-311 Tel: 781/442-0928 > > Burlington, MA 01803-0902 USA Fax: 781/442-1692 > > > > > > ---------------------------------------------------------------- > > To subscribe or unsubscribe from this elist use the subscription > > manager: < http://lists.oasis-open.org/ob/adm.pl > > > > > -- Anne H. Anderson Email: Anne.Anderson@Sun.COM Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692