xacml — archive

[Polar Humenn <polar@syr.edu>]

 MHonArc v2.5.2 -->

















xacml message






[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [Elist Home]








Subject: RE: [xacml] Observation on "context"




From: Polar Humenn <polar@syr.edu>
To: Tim Moses <tim.moses@entrust.com>
Date: Mon, 03 Jun 2002 09:59:59 -0400 (EDT)







Tim,

I am not all that familiar with the intricacies of XPATH. However,
something has been bothering me for quite sometime. It appears that XPATH
can only get you the information at a particular node of a document
downwards, and any upwards information about how you got there is gone,
correct?

For example, suppose there were more than one particular thing referenced
by a prefix of an XPATH expression. Just for fun, let's say we have
multiple resources, If you ask for an attribute of:

<equals>
<RequestContext/Resources/ResourceAttribute[@AttributeName="Forest"]/AttributeValue>
<AttributeValue>
   Sherwood
</AttributeValue>
</equals>

You kind of loose the thing of which had the "Forest" attribute of
"Sherwood", and the only thing at your disposal is
<AttributeValue>Sherwood</AttributeValue>

Cheers,
-Polar


 On Mon, 3 Jun 2002, Tim Moses wrote:

> Anne - I think I am starting to "get the picture".  Forgive me for being
> slow on the uptake.  Would this be another way of putting it ? ...
>
> The basic entities are universal, regardless of the application domain.
> They are the subject, resource and action.  The SAML data models for these
> entities are inadequate.  There are some universal aspects to these data
> models (subjects have attributes, for instance).  But, some elements differ
> between application domains and (in addition) we cannot anticipate how
> domains may need to extend these data models.  This sounds like a job for
> XML, because it can express arbitrarily-complex data models and is
> extensible.
>
> If this is the case, I might want to rethink my view that XPATH is not the
> right way to identify context elements.  If we are deliberately choosing an
> extensible mark-up language to model the context, then perhaps all the tools
> associated with that language should be available to us to manipulate an
> instance of it.  An XPATH expression would be a convenient way to identify
> an element such as: 'the role attribute of the subject whose name is
> "codesigner"'.  For sure, we don't need the full complexity of XPATH, but
> perhaps we could define a small subset.
>
> Thoughts any one?
>
> All the best.  Tim.
>
> -----------------------------------------
> Tim Moses
> Tel: 613.270.3183
>
>
>