Re: [xacml-users] Combining algorithms and "AND" and "OR"

[Anne Anderson <Anne.Anderson@Sun.COM>]

Srinivas,

Informally, deny-overrides returns "deny" unless all policies evaluate
to "permit" or "not-applicable".  permit-overrides returns "permit" if
at least one policy evaluates to "permit" (unless a policy is
encountered prior to any "permit" that evaluates to "deny").  But read
the spec for the full description.

Anne

srinivas.sridhara@nokia.com wrote:
> Does "deny-override" mean that the result of combining a set of policies is "deny" no matter what the other policies evaluate to (i.e. Permit, Indeterminate or NotApplicable) as long as one policy evaluates to Deny. Or does Deny-override apply only to those policies which evaluate to permit or deny. A similar thought for Permit-override too!
> 
> Srinivas
> 
> 
>>-----Original Message-----
>>From: ext Anne Anderson [mailto:Anne.Anderson@Sun.COM]
>>Sent: Wednesday, April 13, 2005 2:44 PM
>>To: Kuketayev, Argyn (Contractor)
>>Cc: xacml-users@lists.oasis-open.org
>>Subject: Re: [xacml-users] Combining algorithms and "AND" and "OR"
>>
>>
>>They are roughly equivalent, but not completely.  They differ from
>>Boolean AND and OR in operating on 4 values - "Permit", "Deny",
>>"NotApplicable", and "Indeterminate" - rather than on 2 ("True",
>>"False").  If "Permit" is treated as equivalent to "True", 
>>and "Deny" is
>>treated as equivalent to "False", and if none of the rules or policies
>>returns "NotApplicable" or "Indeterminate", then I believe they are
>>equivalent.
>>
>>Anne
>>
>>Kuketayev, Argyn (Contractor) wrote:
>>
>>>Can I say that "deny-overrides" is equal to multiplication ("AND"
>>>operator) of results of each rule or policy? Subsequently,
>>>"permit-overrides" is "OR" operator?
>>>
>>>Thanks,
>>>Argyn
>>
>>-- 
>>Anne H. Anderson             Email: Anne.Anderson@Sun.COM
>>Sun Microsystems Laboratories
>>1 Network Drive,UBUR02-311     Tel: 781/442-0928
>>Burlington, MA 01803-0902 USA  Fax: 781/442-1692
>>
> 
> 

-- 
Anne H. Anderson             Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692