xacml — archive

Re: [xacml] [CR] New Section 7.x: Request context. Forwarded messagefrom Seth Proctor.

From: Anne Anderson <[email protected]>
To: [email protected]
Date: Tue, 08 Oct 2002 20:23:00 -0000

------- start of forwarded message ------- From: Seth Proctor <[email protected]> To: Anne Anderson <[email protected]> Subject: Re: [xacml] [CR] New Section 7.x: Request context Date: Tue, 8 Oct 2002 15:53:14 -0400 > If a referenced attribute is not available in the cached list of > attributes or among those supplied by the PEP, then a request is > made to the PIP for a value for the referenced attribute. This > request is implementation-dependent, and is not visible to the > PDP. If the PIP is not able to supply a value for the attribute, > then a result of "Indeterminate" due to "Missing attribute" is > returned to the PDP. As I pointed out yesterday, the PDP _is not_ shielded from the implementaion dependent stuff. There is no standard that describes what a PIP is, or how a PDP talks to it in any standard way, so either the PDP is the PIP (and therefore knows all the implementation-dependent issues), or the PDP talks to a PIP, and therefore defines an implementation-dependent communication model. Either way, the PDP is not being shielded from anything. If you want to be pedantic about the PIP being a conceptually different thing, that's fine, but from an implementation and an interoperability point of view, it doesn't help anything. Also, in your last paragraph, I think it's confusing how you tried to fold in the language about short-circuit evaluation. This is a separate topic, and needs to be discusssed in greater detail in its own section. seth ------- end of forwarded message ------- -- Anne H. Anderson Email: [email protected] Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692