xacml — archive

Re: [xacml] request's attribute assertion lifetime?

From: Frank Siebenlist <[email protected]>
To: [email protected]
Date: Mon, 15 Mar 2004 18:43:00 -0000

 MHonArc v2.5.0b2 -->

xacml message

[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]

Subject: Re: [xacml] request's attribute assertion lifetime?

From: Frank Siebenlist <[email protected]>
To: Daniel Engovatov <[email protected]>
Date: Mon, 15 Mar 2004 10:57:05 -0800

I remember that we had some discussions about the need to limit the 
expressiveness of XACML in WSPL for reasons very similar to the ones you point out.

One observation of the delegation of rights processing was that you could 
potentially chain authorization decsions from issuer to subject, but that 
chaining general delegation-policy statements was to hard because of the same 
reasons you point out.

It seems that Tim's "visionary" WSPL may prove more valuably outside of its 
intended scope. (or maybe Tim was even more visionary than I give him credit for ;-)

-Frank.

Daniel Engovatov wrote:

> How would you deal with caching a decision from a policy
> Grant(something) (from 3 to 5) and (direction =  in)
> Deny(same thing) (from 4 to 4:30) and (last_name = engovatov)
> 
> Simple intersections will not cut it.   To deal with intervals properly
> you do need to express them as a data type.  To cache anything you need
> to trace ALL changes in the context, not just time.
> 
> I doubt it would be simple.   And you already can express all this rules
> using XACML and extensions to XACML - it just would not be easy to
> construct a query that answers your question.
> 
> Daniel.
> 
> 
>