xacml — archive

[David Chadwick]

Hi Prateek Prateek Mishra wrote: > David, > > my concern is that use of "any" in schema is a very blunt tool to > achieve your goals. agreed. I am happy to sharpen it if you can suggest a construct for this. Secondly, this puts a large burden on implementors > that are creating > SAMLAuthZRequest processors - how does the processor know which policy > language is being used? we have already defined a schema for this in our project (see below), but we are not proposing to standardise this yet. (But we could if people wanted to). > THere are whole range of messy issues that > would need to be resolved. > > The kind of extension you seek is better achieved by creating a new type > - lets call it ExtendedSAMLAuthZRequest - which extends from > SAMLAuthZRequest this is what I actually did in my schema, I gave it a revised name. So would you be happy for the SAML2 XAMCL spec to have two statements in it, the SAMLAuthzRequest and the ExtendedSAMLAuthzRequest which allows any policy to be included? If so, I would prefer the first to be called SAMLXACMLAuthzRequest and the second ExtendedSAMLAuthzRequest so that the name carries the semantic difference. > and includes the fields you need. Another alternative would be to > completely re-factor the design of SAMLAuthZRequest to accomodate the > use of multiple policy languages - you would need some way to represent > the identity or name of the policy language in the request so that the > processor can reasonably understand the contents of the AuthZRequest and > fail appropriately. we have already done this in our project as below, with the following schema. But we are not proposing to offer this for standardisation yet ( not until we at least get more experimental experience of using it).