Re: [xacml-dev] remote PDP

[Seth Proctor <Seth.Proctor@Sun.COM>]

On Oct 10, 2004, at 4:04 PM, Argyn wrote:
> On Sun, 10 Oct 2004 15:31:41 -0400, Seth Proctor 
> <Seth.Proctor@Sun.COM> wrote:
>> If you're willing to pass those attributes in a Request, have them 
>> available through some interface, or do a multi-phased exchange, then 
>> you've got no problems.
>
> actually, this multi-phased exchange is what I'm thinking about. I 
> don't know in advance what's required. So, if PDP needs more 
> attributes it has to get them from application's PEP. it's more 
> network traffic, and slows down the decision making.

You've hit right on the tradeoff here. You get an easy way for the PDP 
to do a partial evaluation and tell the PEP what it needs to provide 
next, but it's possibly much more expensive. If you want to get fancy, 
your PEP can keep track of which attributes were needed for a given 
request, and remember so that in the future you include all attributes 
that are probably needed in the initial request. But yes, generally, 
it's a tradeoff.


seth