xacml — archive

[Paul Tyson]

I agree there is a lot of ambiguity in the various XML data models and implementations. It is difficult to specify a reliable way of constructing the XML content that will be tested in a XACML context. But I do not think the data structure should include the xacml:Content element. If xacml:Content is the document element, then "/*" returns the element node, "xacml:Content". I would have to write "/*/*" to get to my content. I propose modifying the schema to limit the xacml:Content element to one element child, and specifying that this element will become the document element of the XML data structure that is accessible to XACML xpath expressions. This should be easy to implement by constructing a new document object from the child element of xacml:Content. Processing instructions and comments from the