xacml — archive

RE: [xacml] bags and targets. Forwarded message from Seth Proctor

From: Anne Anderson <[email protected]>
To: [email protected]
Date: Tue, 29 Oct 2002 20:36:00 -0000

I have the following action item: 0142: [Seth Proctor] bags and targets. Forwarded message from Seth Proctor. e-mail sent 17 Oct 2002 16:43:04 -0400 (EDT) http://lists.oasis-open.org/archives/xacml/200210/msg00216.html ACTION ITEM: [Anne] Write up TENTATIVE RESOLUTION with details spelled out. STATUS: UNRESOLVED (10/28). See TENTATIVE RESOLUTION. TENTATIVE RESOLUTION: Create a new XML attribute on Designators and Selectors to indicate "Must be present". This new attribute is optional, and may be used in either Target or Condition. Behavior of indeterminate results in Target where AND or especially OR is being done (e.g. in multiple subjects where only one needs to match) needs to be spelled out, but it should follow behavior of current "and" and "or" functions. Here is my attempt at writing up the details: 1. In policy schema: Change <xs:complexType name="AttributeSelectorType"> <xs:attribute name="RequestContextPath" type="xs:string" use="required"/> <xs:attribute name="DataType" type="xs:anyURI" use="required"/> </xs:complexType> To: <xs:complexType name="AttributeSelectorType"> <xs:attribute name="RequestContextPath" type="xs:string" use="required"/> <xs:attribute name="DataType" type="xs:anyURI" use="required"/> <xs:attribute name="MustBePresent" type="xs:boolean" use="optional" default="false"/> </xs:complexType> 2. In policy schema, Change <xs:complexType name="AttributeDesignatorType"> <xs:attribute name="AttributeId" type="xs:anyURI" use="required"/> <xs:attribute name="DataType" type="xs:anyURI" use="required"/> <xs:attribute name="Issuer" type="xs:anyURI" use="optional"/> </xs:complexType> To: <xs:complexType name="AttributeDesignatorType"> <xs:attribute name="AttributeId" type="xs:anyURI" use="required"/> <xs:attribute name="DataType" type="xs:anyURI" use="required"/> <xs:attribute name="Issuer" type="xs:anyURI" use="optional"/> <xs:attribute name="MustBePresent" type="xs:boolean" use="optional" default="false"/> </xs:complexType> 3. Section 5.23 Complex type AttributeDesignatorType, append following to the very end of this section (after Issuer [Optional] description): MustBePresent [Optional] The MustBePresent attribute governs whether the AttributeDesignator element returns an empty bag or indeterminate in the case of finding no value for the named attribute in the request context. If the value can not be located and the MustBePresent attribute is set to false, then the AttributeDesignator element SHALL result in an empty bag. If the value can not be located and the MustBePresent attribute is set to true, then the AttributeDesignator element SHALL result in indeterminate. Regardless of the MustBePresent attribute, if it cannot be determined whether the attribute is present or not present in the request context, or if the value of the attribute is unavailable due to any error, then the AttributeDesignator element SHALL result in indeterminate. The default value for the MustBePresent attribute is false. 4. Section 5.29 Element <AttributeSelector>, append following to the very end of this section (after DataType [Required] description): The MustBePresent attribute governs whether the AttributeSelector element returns an empty bag or indeterminate in the case of finding no value for the named attribute in the request context. If the value can not be located and the MustBePresent attribute is set to false, then the AttributeSelector element SHALL result in an empty bag. If the value can not be located and the MustBePresent attribute is set to true, then the AttributeSelector element SHALL result in indeterminate. Regardless of the MustBePresent attribute, if it cannot be determined whether the attribute is present or not present in the request context, or if the value of the attribute is unavailable due to any error, then the AttributeSelector element SHALL result in indeterminate. The default value for the MustBePresent attribute is false. Are there any other places that need a change? Anne -- Anne H. Anderson Email: [email protected] Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692