xacml — archive

RE: [xacml] request's attribute assertion lifetime?

From: Polar Humenn <[email protected]>
To: [email protected]
Date: Mon, 15 Mar 2004 19:19:00 -0000

 MHonArc v2.5.0b2 -->

















xacml message






[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]








Subject: RE: [xacml] request's attribute assertion lifetime?




From: Polar Humenn <[email protected]>
To: Daniel Engovatov <[email protected]>
Date: Mon, 15 Mar 2004 14:30:24 -0500 (EST)







I agree. You can easily supply a datatype that has interval information in
it, and you can write functions on that data type that support your
intervals, whether they be time, or mile markers.  You even could use XML,
using the structured data type.

-Polar


On Mon, 15 Mar 2004, Daniel Engovatov wrote:

>
> How would you deal with caching a decision from a policy
> Grant(something) (from 3 to 5) and (direction =  in)
> Deny(same thing) (from 4 to 4:30) and (last_name = engovatov)
>
> Simple intersections will not cut it.   To deal with intervals properly
> you do need to express them as a data type.  To cache anything you need
> to trace ALL changes in the context, not just time.
>
> I doubt it would be simple.   And you already can express all this rules
> using XACML and extensions to XACML - it just would not be easy to
> construct a query that answers your question.
>
> Daniel.
>
>
>