Won't the initial Request go to a single PDP? And that PDP might
invoke others to evaluate sub-policies?
If that is the case, then the initial PDP could add its concept of
"current-time/date/dateTime" to the Request context that it sends
to any other PDP for subordinate evaluation.
-Anne
"Daniel Engovatov" <> wrote:
>Date: Tue, 12 Aug 2003 13:06:31 -0700
>>We already require these values be provided, so there's no
>>complication in keeping them constant, and this certainly isn't out of
>>scope of XACML since it defines how a standard attribute should be
>>handled during policy evaluation. This has nothing to do with
>geographic
>>location or accuracy.
>
>But what if the evaluation is distributed? It should be possible.
>Also, it may be a problem to keep them constant - PDP may not have the
>caching of data, and PIP may not be aware of the duration of the
>evaluation session.
>I do not think we should specify the architecture of PIP and for data
>paths provided from the virtual context - things like caching, sessions
>etc. are too specific to a particular implementation.
>Yes, that means that a time-based policy is not 100% portable, but
>nothing that rely on an external information source is 100% portable.
>For 100% portability this attribute has to be specified in the request,
>and is such a case we already state (do we ?) that it will be constant
>for the duration of the evaluation, and no further clarifications are
>needed.
>
>>If you refer to current-time twice in a policy where the value is being
>>supplied by the PDP, one implementation might return two slightly
>>different values while another might return the same value twice. This
>>is not likely to be a huge problem, but it does represent different
>>behavior across different applications, and it can be addressed without
>>too much difficulty.
>
>That's what I am not sure about. Why XACML should address the value of
>time? If it is the accuracy that you are worried about - then we have
>to specify the expected accuracy.
>
>>I'm not sure what adjusting clocks has to do with this...
>
>If your PDPs are on different machines, they may have different clocks.
>I think we should not be in the business of synchronizing them.
>
>Daniel.
>
>
>You may leave a Technical Committee at any time by visiting
>http://www.oasis-open.org/apps/org/workgroup/xacml/members/leave_workgroup.php
>
Anne
------
Anne H. Anderson
Sun Microsystems Laboratories
Burlington, MA 781-442-0928
