xacml — archive

[Bill Parducci]

Time: 10:00 am EDT I. Roll Call Hal Lockhart (Chair) Bill Parducci (Co-Chair, minutes) Erik Rissanen Paul Tyson Seth Proctor Sridhar Muppidi Jan Herrmann Rich Levinson Dilli Arumugam John Tolbert David Staggs Voting Members: 11 of 13 (84% per kavi) II. Administrivia Vote to approve Minutes from 3 December 2009 TC Meeting APPROVED unanimously F2F The TC is asked to post to the list any issues/corrections to the Raw Notes from 8-10 December 2009 F2F Meeting. Attendance for the F2F was tracked for the first day and includes all attendees from any day. Hal reviewed the F2F events, output documents. Hal suggested that the Public Review be delayed until after January 1st to ensure ample opportunity for Oasis members to review the current documents. Rich raised the question of the presentation by Next Labs being contributed to the TC list for reference. Hal will follow up with Next Labs. The next TC meeting will be held on 7 January 2010. III. Issues Obligation with Combined Decisions The current Draft defines that multiple decisions cannot be combined with Obligations. Rather, the PDP will return an Indeterminate. Hal suggested that the PDP return the collection of Obligations as with existing Combining Algorithms. Paul offered that he believes it should Indeterminate because it breaks the relationship with the resource. Jan is comfortable discarding Obligations in Combined Decision results. Hal decided that he is in line with more conservative approach of issuing an Indeterminate when an Obligation or Advice is present (requiring a request for a full enumeration of decisions). Paul offered that the Combined Decisions circumvent the intent of the Policy Author. Erik noted that this is the same issues as the case described in Section 3.2. Paul pointed out that the PDP can generate a PERMIT or DENY upon combining decisions (rather than being limited to Not Applicable or Indeterminate) and that this breaks the fundamental PEP/PDP model. Paul proposed a single fixed decision combiner: PERMIT if all individuals decisions are PERMIT or DENY if all individual decisions are DENY. Jan agreed with Paul. Paul proposed to take out the decision combining algorithms and explicitly specify how the decision must be returned (effectively is that all individual decisions must be the same or an Indeterminate is returned, including Not Applicable). There is general consensus that this be adopted. The DecisionCombingAlgorithmId attribute must be replaced. Entire Hierarchy Paul raised how this may apply to Entire Hierarchy functionality. Rich offered that this is just a special case of a Combined Decision. Hal concurred. Paul that there may be a case where an implied semantic relationship that assist in the decision making process. Erik offered that if the Policy Author's intent is violated the result is the same. Paul will work up a Use Case. XPath Attribute Selector Paul is arguing for a very liberal implementation of XPath functionality, while Erik is concerned about potential ambiguities. This will be discussed further on the list. meeting adjourned.