[xacml-comment] RE: XACML questions ...

Gene - 
I'll pass your questions on to the XACML comment list, in order to ensure that 
they get recorded and addressed, and that any lack of clarity is 
corrected.
Basically, attributes of subjects, 
resources and actions (but not environment) may appear in a policy's 
target.  A policy is applicable to a request if at least one of its subject 
matches is true AND at least one of its resource matches is true AND at least on 
of its action matches is true.  AttributeSelector may be used 
in any of these match types.  In the case of a subject match, for 
instance, the "context" node for the XPath expression is 
xacml-context/Subject.  And similarly for the other types.
On the other hand, AttributeSelector may also be used 
in an Apply element to define an argument to an expression.  In this case, 
the "context" node for the XPath expression is the whole xacml:context.  
So, it can select any attribute of any entity (subject, resource, action or 
environment), but it has to explicitly indicate which type of entity is 
intended.

Hope this helps.  All the best.  
Tim.

  
    
-----Original Message-----
From: Gene Thurston 
    [mailto:]
Sent: Wednesday, November 20, 
    2002 8:21 PM
To: 'Tim Moses'
Subject: XACML questions 
    ...

    

    
Hi 
    Tim,

    
 

    
I was working with the latest 
    XACML draft, and I had a few questions, mostly around the optional XPath 
    capability outlined in it:

    
 

    
      
Why is 
      there no <EnvironmentMatch>, similar to 
      <SubjectMatch>, <ResourceMatch>, and <ActionMatch>? 
      
When 
      used inside a <SubjectMatch> element, is the XPath expression found in the 
      <AttributeSelector> evaluated over the entire 
      context document, or just over the <Subjects> sub-tree?  
      
Same 
      question for <ResourceMatch> and <ActionMatch>? 
      
If the 
      answer to the above is that the XPath expressions are always evaluated 
      over the entire context document, then what are the semantics if such an 
      expression inside, say, a <SubjectMatch> element evaluates to something outside 
      the <Subjects> sub-tree?  Is this just, “OK” (as I suspect), 
      or is there supposed to be something special about the fact that it was 
      inside a <SubjectMatch> so we shouldn’t match anything outside the 
      subject’s attributes? 
      
If it 
      is “OK”, then there is no difference between <SubjectMatch>, <ResourceMatch>, or <ActionMatch>, and perhaps there should be a generic 
      <AttributeSelectorMatch> or something 
      similar? 

    
 

    
I would much appreciate any 
    clarifications here.

    
 

    
Thanks,

    
 

    
- Gene Thurston 
    -

    
AmberPoint, 
    Inc.