xacml — archive

[System]

>Unfortunately, the first argument, by the schema, says that it must be the >Selector or Designator. The explicit value to match against is the second >element in the schema. To reverse them, which I wouldn't mind, we would >need a SCHEMA change, and I would have to change the definition of the >match functions. I would not mind it either. Other wise we either should use only the sequence type functions (at-least-one-member-of, set-equals), of member-of, with one argument specified as <attributevalue> element. *-equal would be illegal. Otherwise we need to allow arguments to be *-first-and-only, or *-sequence functions, and in this case why not to use the same semantics as for <condition> element altogether. daniel;