Re: [xacml-users] Attributes for domain objects

---------- Forwarded message ----------
From: Argyn <>
Date: Mar 20, 2006 2:16 PM
Subject: Re: [xacml-users] Attributes for domain objects
To: Adam Constabaris <>


On 3/20/06, Adam Constabaris <> wrote:
> I would like to be able to write policies for domain objects of several
> types.
[skip]

> The general question is whether there's some wisdom (hopefully tested
> wisdom =) on how to accomplish this.  I've had two basic thoughts, one
> of which is to try to mush the object type into the resource-id
> attribute, and the other of which is to add a resource-type attribute.

that's what i implemented in one place. my resource ids were like
"com.fatclient.finance.cool-application.screens.login-screen" or
"com.fatclient.finance.cool-application.menuitems.admin" etc.

think of hierarchical X500 name type of things, which are used in LDAP
to locate objects in trees. it worked fine for me

thanks
argyn