Re: [xacml-dev] XACML Attribute values locaters

Hi,

That is a very vendor-specific question and this is probably not the best place to ask.

Generally, you should make sure the vendor you go for does follow the XACML architecture closely (PAP-PEP-PDP-PRP-PIP) and in particular in your case PDP-PIP.

If the vendor does implement this decent architecture, then it means you can easily integrate with pretty much any source of attributes (or in XACML terms, any PIP). You should ask the vendor what their off-the-shelf connectors are and also ask whether they have an open API so that customers can extend the product themselves.

Cheers,
David.

On Wed, Apr 27, 2011 at 12:18 PM, Security Developer <> wrote:

Thanks for the nice explanation. I have one more question please

What are the major attribute repositories supported by most XACML vendors apart from LDAP and Databases?

Thanks.

On Wed, Apr 27, 2011 at 2:33 PM, David Brossard <> wrote:

Hi,

In addition to Ludwig's comments, it might be the case that the PEP doesn't have access to all the sources of attributes or is not authorized to access the needed sources of attributes.

Cheers,

David.

On Wed, Apr 27, 2011 at 11:15 AM, Ludwig Seitz <> wrote:

On ons, 2011-04-27 at 13:57 +0500, Security Developer wrote:

> Hi,

>

> What is the real time use case when XACML PDP has to find the

> attribute values from external sources i.e. LDAP, Database etc.

>

> Why not authentication system return all the attributes of a subject

> so the XACML PDP do not have to locate the attribute values?

>

> More explanation about the related topic would be highly appreciated.

>

> Thanks and Best Regards.

The PEP might not know which attributes are required by the policies

when submitting the request to the PDP, or it might be bad for

performance to retrieve all attributes for each request (since many of

them might not be needed for a specific request).

Regards,

Ludwig

--

Ludwig Seitz, PhD

Swedish Institute of Computer Science

Ideon Science Park

Building Beta 2 3v

Scheelev輍en 17

SE-223 70 Lund

Phone +46(0)70-349 92 51

http://www.sics.se

---------------------------------------------------------------------

To unsubscribe, e-mail: 

For additional commands, e-mail: 

-- 
David Brossard, M.Eng, SCEA, CSTP
Solutions Architect
+46(0)760 25 85 75

Axiomatics AB
Skeppsbron 40
S-111 30 Stockholm, Sweden

http://www.linkedin.com/companies/536082
http://www.axiomatics.com
http://twitter.com/axiomatics

-- 
David Brossard, M.Eng, SCEA, CSTP
Solutions Architect
+46(0)760 25 85 75
Axiomatics AB
Skeppsbron 40

S-111 30 Stockholm, Sweden
http://www.linkedin.com/companies/536082
http://www.axiomatics.com

http://twitter.com/axiomatics