xacml — archive

[Prateek Mishra]

This note describes a deployment scenario that we are increasingly encountering. It highlights some area where we believe XACML 2.0 may need extension. We describe the scenario using terminology taken from Sec 3.1 of [xacml-2.0-core]. SCENARIO ------------- An enterprises utilizes a variety of applications and COTS to access resources. Each component includes an embedded PEP for access control. Some components may include some resource management aspects and so include some part of a context-handler as part of the PEP ('enhanced PEP"). New components and devices with embedded PEPs are being acquired by the enterprise over time. The enterprise has an existing access control policy infrastructure based on XACML, including one more PDPs. (1) What protocol should the enterprise require the PEPs to implement? One strategy is to use the