xacml — archive

[Jean-Paul Buu-Sao]

Danny, "An example of a feature which would require evaluation of the policy template in the PDP at request time: If the policy template data format were extended to allow AttributeDesignator or AttributeSelector elements in Parameter definitions alongside simple attribute value elements. Such constructs cannot be expanded at policy design time (A) nor at import time (B) because their values will vary per auth request" Thanks for this helpful example. This example suggests that we need to enumerate the various elements that could be parameterized, and the associated required level of support. I provided examples for the first case a) below. Would you have some business examples for the cases that you mentioned, and other cases in mind? a) AttributeValue (support: static and dynamic reduction) - syntax: see examples https://wiki.oasis-open.org/xacml/Policy%20Template%20Profile%20Examples b) AttributeDesignator (support: dynamic reduction) - syntax: need example c) AttributeSelector (support: dynamic reduction) - syntax: need example d) others? Thanks, Jean-Paul Buu-Sao