MHonArc v2.5.2 -->
xacml message
[Date Prev]
| [Thread Prev]
| [Thread Next]
| [Date Next]
--
[Date Index]
| [Thread Index]
| [Elist Home]
Subject: Re: [xacml] change request: xacml context attributes and data types
On Fri, 27 Sep 2002, Anne Anderson wrote:
> But, as discussed on yesterday's call, a <Subject> may have more
> than one subject-id attribute. For example, one may give the
> rfc822Name under which the subject authenticated, and another may
> give the x500Name.
>
> The datatype is required to allow the AttributeDesignator to
> select the instance of the attribute that has the correct
> datatype for the function in which the designator occurs.
Right, if the dataType attribute exists, if you are looking for attributes
of a particular datatype, of which our XACML strong type system will
infer, you can pick them out of the context by the dataType attribute.
It can be optional, however, as I pointed out in my last email, you have
to decide on what to do with the designator if the AttributeValue isn't a
valid parseable representation of the data type named in the dataType
attribute.
Finish Vodka
Cheers,
-Polar
>
> Anne
>
> On 27 September, Simon Godik writes: [xacml] change request: xacml context attributes and data types
> > From: Simon Godik <simon@godik.com>
> > To: xacml@lists.oasis-open.org
> > Subject: [xacml] change request: xacml context attributes and data types
> > Date: Fri, 27 Sep 2002 00:30:29 -0700
> >
> > Currently <xacml-context:Attribute> element allows DataType attribute.
> >
> > Rationale for keeping DataType attribute in the <xacml-context:Attribute> element was that
> > it can sometimes be helpful, such as specifiying subject-id format, like
> > subject-id="cn=simon", data-type="x500-name"
> >
> > But this information is redundant, because subject-id attribute will be passed to the specific
> > function that expects arguments of certain type. For example, if subject-id is passed to
> > the x500Name-equal function it expects it's arguments to be in x500 name format.
> >
> > So data type does not add value here.
> >
> > Another problem is that we can not access DataType attribute with AttributeDesignator.
> >
> > Proposal: remove DataType attribute from the <xacml-context:Attribute>.
> >
> > Simon
> >
> > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
> > <HTML><HEAD>
> > <META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
> > <META content="MSHTML 5.50.4522.1800" name=GENERATOR>
> > <STYLE></STYLE>
> > </HEAD>
> > <BODY bgColor=#ffffff>
> > <DIV><FONT face=Arial size=2>Currently <xacml-context:Attribute> element
> > allows DataType attribute.</FONT></DIV>
> > <DIV><FONT face=Arial size=2></FONT> </DIV>
> > <DIV><FONT face=Arial size=2>Rationale for keeping DataType attribute in the
> > <xacml-context:Attribute> element was that</FONT></DIV>
> > <DIV><FONT face=Arial size=2>it can sometimes be helpful, such as specifiying
> > subject-id format, like</FONT></DIV>
> > <DIV><FONT face=Arial size=2>subject-id="cn=simon",
> > data-type="x500-name"</FONT></DIV>
> > <DIV><FONT face=Arial size=2></FONT> </DIV>
> > <DIV><FONT face=Arial size=2>But this information is redundant, because
> > subject-id attribute will be passed to the specific</FONT></DIV>
> > <DIV><FONT face=Arial size=2>function that expects arguments of certain type.
> > For example, if subject-id is passed to</FONT></DIV>
> > <DIV><FONT face=Arial size=2>the x500Name-equal function it expects it's
> > arguments to be in x500 name format.</FONT></DIV>
> > <DIV><FONT face=Arial size=2></FONT> </DIV>
> > <DIV><FONT face=Arial size=2>So data type does not add value here.</FONT></DIV>
> > <DIV><FONT face=Arial size=2></FONT> </DIV>
> > <DIV><FONT face=Arial size=2>Another problem is that we can not access DataType
> > attribute with AttributeDesignator.</FONT></DIV>
> > <DIV><FONT face=Arial size=2></FONT> </DIV>
> > <DIV><FONT face=Arial size=2>Proposal: remove DataType attribute from the
> > <xacml-context:Attribute>.</FONT></DIV>
> > <DIV><FONT face=Arial size=2></FONT> </DIV>
> > <DIV><FONT face=Arial size=2>Simon</FONT></DIV>
> > <DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>
>
> --
> Anne H. Anderson Email: Anne.Anderson@Sun.COM
> Sun Microsystems Laboratories
> 1 Network Drive,UBUR02-311 Tel: 781/442-0928
> Burlington, MA 01803-0902 USA Fax: 781/442-1692
>
>
> ----------------------------------------------------------------
> To subscribe or unsubscribe from this elist use the subscription
> manager: <http://lists.oasis-open.org/ob/adm.pl>
>
[Date Prev]
| [Thread Prev]
| [Thread Next]
| [Date Next]
--
[Date Index]
| [Thread Index]
| [Elist Home]
Powered by eList eXpress LLC