Gene -
I'll pass your questions on to the XACML comment list, in order to ensure that
they get recorded and addressed, and that any lack of clarity is
corrected.
Basically, attributes of subjects, resources and actions (but not
environment) may appear in a policy's target. A policy is applicable
to a request if at least one of its subject matches is true AND at least one of
its resource matches is true AND at least on of its action matches is
true. AttributeSelector may be used in any of these match
types. In the case of a subject match, for instance, the "context" node
for the XPath expression is xacml-context/Subject. And similarly for the
other types.
On the
other hand, AttributeSelector may also be used in an Apply element to define an
argument to an expression. In this case, the "context" node for the XPath
expression is the whole xacml:context. So, it can select any attribute of
any entity (subject, resource, action or environment), but it has to explicitly
indicate which type of entity is intended.
Hope
this helps. All the best. Tim.
-----Original Message-----
From: Gene Thurston
[mailto:]
Sent: Wednesday, November 20, 2002
8:21 PM
To: 'Tim Moses'
Subject: XACML questions
...
Hi
Tim,
I was working with the latest
XACML draft, and I had a few questions, mostly around the optional XPath
capability outlined in it:
Why is
there no <EnvironmentMatch>, similar to <SubjectMatch>, <ResourceMatch>, and <ActionMatch>?
When
used inside a <SubjectMatch> element, is the XPath expression found in the
<AttributeSelector> evaluated over the entire
context document, or just over the <Subjects> sub-tree?
Same
question for <ResourceMatch> and <ActionMatch>?
If the
answer to the above is that the XPath expressions are always evaluated over
the entire context document, then what are the semantics if such an
expression inside, say, a <SubjectMatch> element evaluates to something outside
the <Subjects> sub-tree? Is this just, “OK” (as I suspect),
or is there supposed to be something special about the fact that it was
inside a <SubjectMatch> so we shouldn’t match anything outside the
subject’s attributes?
If it is
“OK”, then there is no difference between <SubjectMatch>, <ResourceMatch>, or <ActionMatch>, and perhaps there should be a generic
<AttributeSelectorMatch> or something
similar?
I would much appreciate any
clarifications here.
Thanks,
- Gene Thurston
-
AmberPoint,
Inc.
