xacml — archive

RE: [xacml] summary of Frank's delegation proposal

From: Anne Anderson <[email protected]>
To: [email protected]
Date: Tue, 18 May 2004 18:47:00 -0000

 MHonArc v2.5.0b2 -->

















xacml message






[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]








Subject: RE: [xacml] summary of Frank's delegation proposal




From: Anne Anderson <[email protected]>
To: Steve Anderson <[email protected]>
Date: Tue, 18 May 2004 14:51:42 -0400






On 18 May, Steve Anderson writes: RE: [xacml] summary of Frank's delegation proposal
 > In Round 2 of your Simple Example, shouldn't it be 
 >     Can Subjects D=Manager1 and S=Manager2 do Action A to Resource R?
 > rather than
 >     Can Subjects D=Manager2 and S=Manager2 do Action A to Resource R?

You are right.  My typo.  Thanks for the catch.

 > As far as that goes, I'm not clear why (according to Step 3b)
 > the new Subject corresponding to the Issuer is added to the
 > request, rather than replacing the previous Subject.  In other
 > words (returning to Round 2 of the Simple Example), 
 > 
 >     Can Subject D=Manager1 do Action A to Resource R?

An Issuer who is delegating rights to another entity may limit
the set of Subjects for which the delegate can issue valid
policies.  The delegate may not even be allowed to do things that
the delegate is allowed to let other entities do.

Anne

 >