item "G" alternative: indexing hints

Item "G" aims to solve indexing problem by creating 
new element in the rule head.

 

A simple alternative would be to provide indexing 
hints in the Policy element.

We can define IndexingHints element as a child of 
the Policy element.

It would contain a sequence of attribute 
designators for indexing.

 

<xs:complexType 
name="IndexingHintsType">

<xs:sequence minOccurs="0" 
maxOccurs="unbounded">

    <xs:choice>

        
<xs:element ref="xacml:SubjectAttributeDesignator"/>

        
<xs:element ref="xacml:ResourceAttributeDesignator"/>

        
<xs:element ref="xacml:ActionAttributeDesignator"/>

        
<xs:element ref="xacml:EnvironmentAttributeDesignator"/>

    </xs:choice>

</xs:sequence>
</xs:complexType>

 

<Policy ...>

    
<IndexingHints>

        
<SubjectAttributeDesignator AttributeId="group" .../>

        
<ActionAttributeDesignator AttributeId="read" .../>

        <EnvironmentAttributeDesignator 
AttributeId="purpose" .../>
    
</IndexingHints>
</Policy>

 

If rule contains indexable expression on an 
attribute specified in the indexing hints, rule MAY be 
indexed.

Indexing rules is not a MUST, ie if xacml processor 
does not index rules it is still compliant (but not very fast) 
processor.

 

Simon