OASIS eXtensible Access Control Markup Language (XACML) TC

RE: [xacml] Revised specification - added matching functions

  • 1.  RE: [xacml] Revised specification - added matching functions

    Posted 08-21-2002 19:04
    They are all sequenced - if there is one instance of foo in the context (in my example) it will be exactly the same input. The difference between declared single<type> and ne_sequence<type> is ONLY the specified behavior, when function is given a sequence of a particular size. function taking single<type>, should produce an error is the SEQUENCE provided as the argument, is of size != 1, function specified ne_sequence<type>, should process sequence of any size >0 - it will process single<type> just as well. On the other hand - if you do not restrict to a non-empty sequence - you have to specify the result for an empty sequence (missing attribute). To clarify my proposal. Let have an attribute foo, of type decimal that may be present in context 0, 1, or 5 times. I need two rules First - should check if the rounded value of foo, if it is defined one, and only one time, is equal to 42. Second - should check if at least one value, rounded is equal to 3. First rule will have condition (in pseudo language) (integer-equal ((attributevalue type=integer)42) (round (attribute designator name=foo))) It will yield INDERTERMINATE if foo is missing, or present 5 times (that is if sttribute designator returns no, or 5 values in a sequence. Only exactly one returned value is accepted. Second rule will be (integer-member-of ((attributevalue type=integer)3) (round (attribute designator name=foo))) This one will work for 1, or 5 present values returned by the designator, but round will produce error, treated as invalid argument by integer-member-of. Not restricting round to non-empty sequence will require the round returns SOMETHING, when given an empty sequence of decimals, other then an error. What would the result be?