Re: [xacml] subject attribute designator

[Simon Godik <simon@godik.com>]

Polar,
Currently <SubjectMatch> element allows to match 1 attribute designator to 1
attribute value.
A sequence of subject-matches is interperted as 'and' between individual
matches.
In the target we have another element <Subject> that wraps a sequence of
subject-matches.
A sequence of <Subject> elements in the target is intepreted as 'or'.

So recursive example you give is semantically the same as my example.

I'm beginning to think that this piece is a little bit overengineered.

What if we define a <MatchType> that matches 1 attribute designator to 1
attribute value.
(I think we had this before f2f)
Elements of <MatchType> are always enclosed in <Subject>, <Resource>, or
<Action> elements. So
matches within <Subject> are subject attribute matches, matches within
resource are resoure
attribute matches, etc.

In the target we drop <Subjects> element and leave a sequence of <Subject>
elements that in turn
contain a sequence of matches. (Same for <Resources> and <Actions>)

Sequence of <Subject> elements in the target is interpreted as 'or'.
Sequence of subject mathes within
individual <Subject> element is interpreted as 'and'. (Same for <Resource>
seq and <Action> seq).

SubjectAttributeDesignator will contain optional sequence of subject matches
interperted as 'and' bettween
individual matches.

Example:
<Target> <-- note <Subjects> element gone.
    <Subject>
        <SubjectMatch MatchId="string-equal"> <-- match 1 attr to 1 value
            <AttributeDesignator AttributeId="attrA"/>
            <AttributeValue>a1</AttributeValue>
        </SubjectMatch>
        <SubjectMatch MatchId="string-equal"> <-- match 1 attr to 1 value
            <AttributeDesignator AttributeId="AttrB"/>
            <AttributeValue>b1</AttributeValue>
        </SubjectMatch>
        <SubjectMatch MatchId="string-equal"> <-- match 1 attr to 1 value
            <AttributeDesignator AttributeId="AttrC"/>
            <AttributeValue>c1</AttributeValue>
        </SubjectMatch>
    </Subject>
    <Subject> <-- another subject, 'or' between <Subject> elements.
    </Subject>
    ....
</Target>

<SubjectAttributeDesignator AttributeId="AttrA">
    <SubjectMatch MatchId="string-equal"> <-- 'and' between individual
subject-matches.
        <AttributeDesignator AttributeId="AttrB"/>
        <AttributeValue>b1</AttributeValue>
    </SubjectMatch>
    <SubjectMatch MatchId="string-equal">
        <AttributeDesignator AttributeId="AttrC"/>
        <AttributeValue>c1</AttributeValue>
    </SubjectMatch>
</SubjectAttributeDesignator>

Simon

----- Original Message -----
From: "Polar Humenn" <polar@syr.edu>
To: "Simon Godik" <simon@godik.com>
Cc: <xacml@lists.oasis-open.org>
Sent: Thursday, August 08, 2002 11:22 AM
Subject: Re: [xacml] subject attribute designator


> On Thu, 8 Aug 2002, Simon Godik wrote:
>
> > <SubjectAttributeDesignator AttributeId="attrB">
> >     <SubjectMatch MatchId="string-equal">
> >         <SubjectAttributeDesignator AttributeId="subject-category"/>
> >         <AttributeValue>access-subject</AttributeValue>
> >     </SubjectMatch>
> >     <SubjectMatch MatchId="string-equal">
> >         <SubjectAttributeDesignator AttributeId="attrA"/>
> >         <AttributeValue>a1</AttributeValue>
> >     </SubjectMatch>
> > </SubjectAttributeDesignator>
> >
> > This designator will match both subjects.
> >
> > Does it make sense? Should we remove recursion in
subject-attribute-designator, so that
> > subject-match does not refer to subject-attribute-designator again?
>
> Aren't the <SubjectMatches> supposed to be OR'ed, and the recursive
> "where"  semantics are "AND"?
>
> The above says to me give me the value of the attrB attribute from the
> subject that matches an (string-equal subject-category of access-subject)
> OR (string-equal attrA of a1).
>
> Whereas:
>
> <SubjectAttributeDesignator AttributeId="attrB">
>     <SubjectMatch MatchId="string-equal">
>         <SubjectAttributeDesignator AttributeId="subject-category">
>             <SubjectMatch MatchId="string-equal">
>                 <SubjectAttributeDesignator AttributeId="attrA"/>
>                 <AttributeValue>a1</AttributeValue>
>             </SubjectMatch>
>         </SubjectAttributeDesignator>
>          <AttributeValue>access-subject</AttributeValue>
>     </SubjectMatch>
> </SubjectAttributeDesignator>
>
> means give me the value of the attrB attribute from THE subject that
> matches an (string-equal subject-category of access-subject)  AND
> (string-equal attrA of a1).
>
>
>
>
> ----------------------------------------------------------------
> To subscribe or unsubscribe from this elist use the subscription
> manager: <http://lists.oasis-open.org/ob/adm.pl>
>
>
>