xacml — archive

RE: [xacml] request's attribute assertion lifetime?

From: Daniel Engovatov <[email protected]>
To: [email protected]
Date: Tue, 09 Mar 2004 18:27:00 -0000

 MHonArc v2.5.0b2 -->
















xacml message






[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]








Subject: RE: [xacml] request's attribute assertion lifetime?




From: "Daniel Engovatov" <[email protected]>
To: "Frank Siebenlist" <[email protected]>
Date: Tue, 9 Mar 2004 10:40:49 -0800







Why should we treat time anyhow differently then any other attribute in
the context?   Evaluation happens against the "snapshot" of the context
(or rather a fuzzy snapshot, as we do not regulate how that data will be
cached or provisioned).  Time is just a dimension like any other.

After the decision is made - it is PEP job on how and when to use it.

For your example:
You are asking to evaluate not against a point in the context space,
with "current-time" fixed, but against an uncountable set in that space
(current-time from 4 to 6).  I do not believe you can formulate such a
query in a generic way.  Asking whether you can access at 4, and then at
6 is not sufficient (you can be denied from 17:01 to 17:03)

If you want to test what you can do from 4 to 6, introduce context
parameters "access-begin"  "access-end" of type time, and write policy
making use of them.  For example 
GRANT(enter, building, joe) if access-begin < 2pm and access-end > 5pm.