xacml — archive

RE: [xacml] Context attribute clarification

From: Tim Moses <[email protected]>
To: [email protected]
Date: Tue, 02 Mar 2004 19:59:00 -0000

 MHonArc v2.5.0b2 -->
















xacml message






[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]








Subject: RE: [xacml] Context attribute clarification




From: Tim Moses <[email protected]>
To: "'Seth Proctor'" <[email protected]>,       Tim Moses <[email protected]>
Date: Tue, 2 Mar 2004 15:11:54 -0500 






Seth

I expect the proposal is actually in-line with your understanding.  It is my
attempt to describe it that is out of line.

I think you are saying that, as far as the PDP is concerned, anything
between <AttributeValue> tags is a single attribute (including any xml
attribute of the <AttributeValue> element, itself).  Whether the attribute
is primitive or structured, it is the associated function that should
validate the contents.  In the structured case, it will need some private
way of locating the schema, given the DataType URI.

Here is the current definition:

<xs:element name="AttributeValue" type="xacml-context:AttributeValueType"/>
<xs:complexType name="AttributeValueType" mixed="true">
	<xs:sequence>
		<xs:any namespace="##any" processContents="lax"
minOccurs="0" maxOccurs="unbounded"/>
	</xs:sequence>
	<xs:anyAttribute namespace="##any" processContents="lax"/>
</xs:complexType>

An attribute value that is an unencapsulated sequence of elements is valid
according to this definition.  But, if we expect the function to
schema-validate, doesn't this introduce a problem, because such a sequence
is anonymous?  

My understanding is that the anyAttribute declaration does not REQUIRE the
<AttributeValue> element to have an atribute, but it MAY have one or more.

Awaiting your thoughts.  All the best.  Tim.