Erik Rissanen wrote:
> This issue falls under the broader issue of attribute provisioning,
> which I think is very important and currently somewhat underspecified in
> the XACML world. But this is much because by design XACML chose to
> abstract away this kind of details. This kind of abstraction makes XACML
> more generally applicable and adaptable to different environments and
> growth over time.
> [...]
> So I am opposed to the proposed change in the XACML schema.
For what it's worth I agree with Erik here. This issue has actually come
up a couple of times before. As I recall, the last time was when Anne
and I were looking at some related issues, and she decided to take a
stab at starting to define some basic provisioning configuration. As it
(quickly) grew very complex, I was of the opinion that this is something
best configured separately, rather than trying to wedge it into the
already somewhat verbose policies.
I think the main issue in my mind boils down to how people are likely to
use his feature. I have not yet come across any real-world scenarios
where people want to define different configuration within the same
policy for various Designators. This is the only strong argument I can
think of for including configuration in the policy itself. As long as
configuration is defined per-policy or, more likely, per-PDP, then doing
the configuration separately seems like a much cleaner approach.
seth
