xacml — archive

RE: [xacml] request's attribute assertion lifetime?

From: Daniel Engovatov <[email protected]>
To: [email protected]
Date: Mon, 15 Mar 2004 21:58:00 -0000

MHonArc v2.5.0b2 -->

xacml message

Subject: RE: [xacml] request's attribute assertion lifetime?

From: "Daniel Engovatov" <[email protected]>
To: "Frank Siebenlist" <[email protected]>, "Polar Humenn" <[email protected]>
Date: Mon, 15 Mar 2004 14:12:00 -0800

Why all this intricate, convoluted way of adding completely unneeded
information into the context (Not all policies care about time)
When the problem is (almost trivially) solved by a combination of
existing solutions:

1) Context handler will return INTEDERMINATE for a certificate that is
invalid for any reason (time is only one, quite narrow, dimension)
2) Any interval evaluations can be handled either with explicit
operations, or by introducing a range data type.
3) If one want an explicit policy for time validity: you can use a
separate policy, invoked by the context handler to check this validity,
or introduce all the attribute metadata as part of the context.

In general, sources of context data do NOT have such metadata attached
to it.  In general, they may have zillion of other criteria to determine
validity of a data piece: signatures for example.

We do have an explicit, well defined way of dealing with bad data - the
INDETERMINATE value.

Because, many systems will not have this metadata available, it will
need to be an optional feature.  Why would we add optional features for
functionality that can be solved using existing ones?

I think we should maintain a clear separation of handling data and
handling parametric policy.  PDP is not a good place to deal with
certificates.

And you still did not show how you would deal with other time dependent
rules.

For example

GRANT(swim) if 3pm < time < 5pm  AND tide < 1ft.

What is the "isValid" interval for this policy?

Daniel.