xacml — archive

RE: [xacml] request's attribute assertion lifetime?

From: Daniel Engovatov <[email protected]>
To: [email protected]
Date: Mon, 15 Mar 2004 18:31:00 -0000

 MHonArc v2.5.0b2 -->
















xacml message






[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]








Subject: RE: [xacml] request's attribute assertion lifetime?




From: "Daniel Engovatov" <[email protected]>
To: "Frank Siebenlist" <[email protected]>, <[email protected]>
Date: Mon, 15 Mar 2004 10:45:44 -0800







How would you deal with caching a decision from a policy
Grant(something) (from 3 to 5) and (direction =  in)
Deny(same thing) (from 4 to 4:30) and (last_name = engovatov)

Simple intersections will not cut it.   To deal with intervals properly
you do need to express them as a data type.  To cache anything you need
to trace ALL changes in the context, not just time.

I doubt it would be simple.   And you already can express all this rules
using XACML and extensions to XACML - it just would not be easy to
construct a query that answers your question.

Daniel.