On 29 October, Polar Humenn writes: [xacml] IsPresent semantics
> The MustBePresent attribute governs whether this element
> returns false or indeterminate in the case of finding no value
> for the named attribute in the request context. In this case,
> if the MustBePresent attribute is set to false, which is its
> default value, this element SHALL result in false. However,
> for this case, if the MustBePresent attribute is set to true,
> the expression SHALL result in indeterminate. Regardless of
> the MustBePresent attribute, if it cannot be determined
> whether the attribute is present or not present in the request
> context, or the value of the attribute is unavailable, then
> the expression SHALL result in indeterminate.
This is not clear. I suggest:
The MustBePresent attribute governs whether this element
returns false or indeterminate in the case of finding no value
for the named attribute in the request context. If the value
can not be located and the MustBePresent attribute is set to
false (its default value), then the
<ResourceAttributeIsPresent> element SHALL result in false. If
the value can not be located and the MustBePresent attribute is
set to true, then the element SHALL result in indeterminate.
Regardless of the MustBePresent attribute, if it cannot be
determined whether the attribute is present or not present in
the request context, or if the value of the attribute is
unavailable due to any error, then the
<ResourceAttributeIsPresent> element SHALL result in
indeterminate.
> The DataType attribute MUST match, by
> string [Qname?] equality, that of the DataType attribute of
I would think it would be "anyURI-equal". We are defining the
DataType attribute to be of type anyURI.
> the same <xacml-context:Attribute> element. If the Issuer
> attribute of this <ResourceAttributeIsPresent> element is
> supplied, it MUST match, by string equality, the Issuer
Again, I think it would be "anyURI-equal", since the Issuer
attribute is of type anyURI.
> attribute of the same <xacml-context:Attribute> element.
> If the Issuer attribute of this <ResourceAttributeIsPresent>
> element is not supplied, presence SHALL be governed by
> AttributeId and DataType attributes alone, regardless of the
> Issuer attribute of the same <xacml-context:Attribute> element
> even if the Issuer attribute is not supplied in the located
> <xacml-context:Attribute> element.
Not clear. I suggest.
If the Issuer attribute of this <ResourceAttributeIsPresent>
element is not supplied, presence SHALL be governed by
AttributeId and DataType attributes alone, regardless of the
presence, absence, or actual value of the Issuer attribute of
the otherwise matching <xacml-context:Attribute> element.
> AttributeId [Required]
>
> This attribute SHALL specify the AttributeId of which to match the
> attribute.
Change "of which to match" to "value with which to match"
>
> DataType [Required]
>
> This attribute SHALL specify the DataType of which to match the
> attribute.
Change "of which to match" to "value with which to match"
>
> Issuer [Optional]
>
> This attribute, if supplied, SHALL specify the Issuer of which to
> match the attribute.
>
Change "of which to match" to "value with which to match"
Otherwise, looks OK to me.
Anne
--
Anne H. Anderson Email:
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311 Tel: 781/442-0928
Burlington, MA 01803-0902 USA Fax: 781/442-1692
